Azure Security built-in role

Key Vault Data Access Administrator

Creates and deletes Azure RBAC role assignments for a fixed set of eight Key Vault data-plane roles. The built-in role definition includes an ABAC condition that limits which role definition IDs can be assigned or removed. It has no DataActions and does not itself read keys, secrets, or certificates, but it can create and manage deployments and support tickets.

Control-plane actions (10)

• Microsoft.Authorization/roleAssignments/write
• Microsoft.Authorization/roleAssignments/delete
• Microsoft.Authorization/*/read
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Resources/subscriptions/read
• Microsoft.Management/managementGroups/read
• Microsoft.Resources/deployments/*
• Microsoft.Support/*
• Microsoft.KeyVault/vaults/*/read

Data-plane actions (0)

None — this role grants no data-plane (data access) actions.

Excluded actions (0)

None

Conditions (1)

• Condition version: 2.0

  ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{00482a5a-887f-4fb3-b363-3b7fe8e74483, a4417e6f-fecd-4de8-b567-7b0420556985, 14b46e9e-c2b7-41b4-b07b-48a6ebf60603, e147488a-f6f5-4113-8e2d-b22465e65bf6, 12338af0-0e69-4776-bea7-57ae8d297424, 21090545-7ca7-4776-b22c-e363652d74d2, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, 4633458b-17de-408a-b874-0445c86b69e6})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{00482a5a-887f-4fb3-b363-3b7fe8e74483, a4417e6f-fecd-4de8-b567-7b0420556985, 14b46e9e-c2b7-41b4-b07b-48a6ebf60603, e147488a-f6f5-4113-8e2d-b22465e65bf6, 12338af0-0e69-4776-bea7-57ae8d297424, 21090545-7ca7-4776-b22c-e363652d74d2, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, 4633458b-17de-408a-b874-0445c86b69e6}))

Assignable scopes (1)

• /

Practical scope

Assign at the individual vault whenever possible. The delegation applies at the selected Azure scope and inherited child scopes, so a resource-group or subscription assignment can administer Key Vault data access for every child vault and also create deployments and support tickets across that scope. The built-in condition limits role types but does not replace narrow assignment scope or principal governance.

Common use cases (2)

• Delegate administration of the approved Key Vault Administrator, Certificates Officer, Crypto Officer, Crypto Service Encryption User, Crypto User, Reader, Secrets Officer, and Secrets User assignments at one vault.
• Separate Key Vault data-access delegation from broad Owner or User Access Administrator authority.

Prerequisites (3)

• The target vault must use Azure RBAC, and the delegating administrator must define which principals may receive the conditioned Key Vault roles.
• Confirm that the required delegated role is one of the eight role IDs allowed by the built-in condition; Certificate User and Crypto Service Release User are not in that allowed set.
• The administrator assigning this delegation role needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign directly on one vault and preserve the built-in role-definition condition.
• Grant to a small access-administration group or eligible human administrator and review all role assignments it creates.
• Use a more constrained custom delegation design when allowed principals must also be limited beyond the built-in role-ID condition.

Security considerations (3)

• The assignee can grant highly privileged Key Vault data access, including complete vault-object administration, to principals within the delegated scope.
• The condition limits role definition IDs but does not itself prevent assigning an allowed role to an unintended principal.
• Broad scope multiplies the delegation across inherited vaults and permits deployment and support-ticket changes even though the role has no direct DataActions.

Assignment guidance

Assign Key Vault Data Access Administrator on the individual vault to a dedicated access administrator. Verify that every needed delegated role is in the built-in eight-role allowlist, retain the condition, audit assignment changes, and use broader Owner or User Access Administrator authority only when this conditioned role cannot perform the required task.

Related roles (2)

• Key Vault Administrator: One of the eight data-plane roles that the built-in ABAC condition explicitly permits this administrator to assign or remove.
• Role Based Access Control Administrator: General Azure RBAC delegation role; Key Vault Data Access Administrator is conditioned to a documented Key Vault role allowlist.

Editorial sources (6)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Delegate Azure role assignment management to others with conditions →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →