Azure Security built-in role

Key Vault Secrets Officer

Performs all Key Vault secret data-plane operations, including reading, creating, updating, deleting, recovering, backing up, restoring, and purging secrets, but cannot manage Azure RBAC permissions. Its control-plane Actions also create and manage classic metric alerts, deployments, and support tickets. It works only with vaults using the Azure RBAC permission model.

Control-plane actions (10)

• Microsoft.Authorization/*/read
• Microsoft.Insights/alertRules/*
• Microsoft.Resources/deployments/*
• Microsoft.Resources/subscriptions/resourceGroups/read
• Microsoft.Support/*
• Microsoft.KeyVault/checkNameAvailability/read
• Microsoft.KeyVault/deletedVaults/read
• Microsoft.KeyVault/locations/*/read
• Microsoft.KeyVault/vaults/*/read
• Microsoft.KeyVault/operations/read

Data-plane actions (1)

• Microsoft.KeyVault/vaults/secrets/*

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign at the individual vault whose secret lifecycle the principal administers. Parent-scope assignments are inherited by child vaults and extend the ancillary alert-rule, deployment, and support Actions across the parent scope. Individual-secret assignment is supported only for limited exceptions; Microsoft recommends separate vaults per application and environment for ordinary isolation.

Common use cases (2)

• Create and rotate application credentials, passwords, connection strings, API keys, and other approved Key Vault secrets.
• Recover, back up, restore, delete, or purge secrets during an approved lifecycle or incident-recovery operation.

Prerequisites (3)

• The vault must use Azure RBAC and each secret must have a documented owner, purpose, rotation process, and recovery requirement.
• Confirm that the principal needs lifecycle administration rather than read-only runtime access.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the vault scope.

Best practices (3)

• Keep human secret officers separate from workload identities and use Key Vault Secrets User for applications that only retrieve values.
• Automate rotation, use dual credentials where supported, enable soft delete and purge protection, and monitor every secret access and lifecycle event.
• Store credentials rather than ordinary configuration in Key Vault and use a separate vault per application and environment.

Security considerations (3)

• The role can read every secret value in scope and can replace credentials, delete or purge secrets, or restore secret backups.
• Secret values can include passwords, connection strings, service principal credentials, access keys, and the secret portion of certificates.
• A compromised officer can cause credential theft or application outage and, at broad scope, can also change classic alerts, deployments, and support tickets even though the role cannot assign permissions.

Assignment guidance

Assign Key Vault Secrets Officer to the credential-lifecycle team at the individual vault scope, preferably as eligible human access. Use Secrets User for runtime retrieval, keep role delegation separate, and require review for backup, restore, deletion, or purge operations.

Related roles (2)

• Key Vault Secrets User: Microsoft documents Secrets User for reading secret contents and Secrets Officer for all secret lifecycle actions.
• Key Vault Administrator: Adds all key and certificate data-plane operations when secret data-plane administration is insufficient.

Editorial sources (7)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Secure your Azure Key Vault →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

• Secure your Azure Key Vault secrets →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →