Azure Security built-in role
Key Vault Data Access Administrator
Creates and deletes Azure RBAC role assignments for a fixed set of eight Key Vault data-plane roles. The built-in role definition includes an ABAC condition that limits which role definition IDs can be assigned or removed. It has no DataActions and does not itself read keys, secrets, or certificates, but it can create and manage deployments and support tickets.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 8b54135c-b56d-4d72-a534-26097cfdc8d8
Control-plane actions (10)
Microsoft.Authorization/roleAssignments/writeMicrosoft.Authorization/roleAssignments/deleteMicrosoft.Authorization/*/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Resources/subscriptions/readMicrosoft.Management/managementGroups/readMicrosoft.Resources/deployments/*Microsoft.Support/*Microsoft.KeyVault/vaults/*/read
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Conditions (1)
Condition version: 2.0
((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'})) OR (@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{00482a5a-887f-4fb3-b363-3b7fe8e74483, a4417e6f-fecd-4de8-b567-7b0420556985, 14b46e9e-c2b7-41b4-b07b-48a6ebf60603, e147488a-f6f5-4113-8e2d-b22465e65bf6, 12338af0-0e69-4776-bea7-57ae8d297424, 21090545-7ca7-4776-b22c-e363652d74d2, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, 4633458b-17de-408a-b874-0445c86b69e6})) AND ((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'})) OR (@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId] ForAnyOfAnyValues:GuidEquals{00482a5a-887f-4fb3-b363-3b7fe8e74483, a4417e6f-fecd-4de8-b567-7b0420556985, 14b46e9e-c2b7-41b4-b07b-48a6ebf60603, e147488a-f6f5-4113-8e2d-b22465e65bf6, 12338af0-0e69-4776-bea7-57ae8d297424, 21090545-7ca7-4776-b22c-e363652d74d2, b86a8fe4-44ce-4948-aee5-eccb2c155cd7, 4633458b-17de-408a-b874-0445c86b69e6}))
Assignable scopes (1)
/
Practical scope
Assign at the individual vault whenever possible. The delegation applies at the selected Azure scope and inherited child scopes, so a resource-group or subscription assignment can administer Key Vault data access for every child vault and also create deployments and support tickets across that scope. The built-in condition limits role types but does not replace narrow assignment scope or principal governance.
Common use cases (2)
- Delegate administration of the approved Key Vault Administrator, Certificates Officer, Crypto Officer, Crypto Service Encryption User, Crypto User, Reader, Secrets Officer, and Secrets User assignments at one vault.
- Separate Key Vault data-access delegation from broad Owner or User Access Administrator authority.
Prerequisites (3)
- The target vault must use Azure RBAC, and the delegating administrator must define which principals may receive the conditioned Key Vault roles.
- Confirm that the required delegated role is one of the eight role IDs allowed by the built-in condition; Certificate User and Crypto Service Release User are not in that allowed set.
- The administrator assigning this delegation role needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Assign directly on one vault and preserve the built-in role-definition condition.
- Grant to a small access-administration group or eligible human administrator and review all role assignments it creates.
- Use a more constrained custom delegation design when allowed principals must also be limited beyond the built-in role-ID condition.
Security considerations (3)
- The assignee can grant highly privileged Key Vault data access, including complete vault-object administration, to principals within the delegated scope.
- The condition limits role definition IDs but does not itself prevent assigning an allowed role to an unintended principal.
- Broad scope multiplies the delegation across inherited vaults and permits deployment and support-ticket changes even though the role has no direct DataActions.
Assignment guidance
Assign Key Vault Data Access Administrator on the individual vault to a dedicated access administrator. Verify that every needed delegated role is in the built-in eight-role allowlist, retain the condition, audit assignment changes, and use broader Owner or User Access Administrator authority only when this conditioned role cannot perform the required task.
Related roles (2)
- Key Vault Administrator: One of the eight data-plane roles that the built-in ABAC condition explicitly permits this administrator to assign or remove.
- Role Based Access Control Administrator: General Azure RBAC delegation role; Key Vault Data Access Administrator is conditioned to a documented Key Vault role allowlist.
Common questions
When should I assign the Key Vault Data Access Administrator Azure role?
Assign Key Vault Data Access Administrator when you need to: Delegate administration of the approved Key Vault Administrator, Certificates Officer, Crypto Officer, Crypto Service Encryption User, Crypto User, Reader, Secrets Officer, and Secrets User assignments at one vault.; and Separate Key Vault data-access delegation from broad Owner or User Access Administrator authority.. Practical scope: Assign at the individual vault whenever possible. The delegation applies at the selected Azure scope and inherited child scopes, so a resource-group or subscription assignment can administer Key Vault data access for every child vault and also create deployments and support tickets across that scope. The built-in condition limits role types but does not replace narrow assignment scope or principal governance.
What permissions does the Key Vault Data Access Administrator Azure role grant?
The role definition grants 10 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/roleAssignments/write; Microsoft.Authorization/roleAssignments/delete; Microsoft.Authorization/*/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Resources/subscriptions/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Key Vault Data Access Administrator Azure role?
Key considerations when assigning Key Vault Data Access Administrator: The assignee can grant highly privileged Key Vault data access, including complete vault-object administration, to principals within the delegated scope.; The condition limits role definition IDs but does not itself prevent assigning an allowed role to an unintended principal.; and Broad scope multiplies the delegation across inherited vaults and permits deployment and support-ticket changes even though the role has no direct DataActions.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for Security →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Grant permission to applications to access an Azure key vault using Azure RBAC →
Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Delegate Azure role assignment management to others with conditions →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.