Azure Security built-in role
Key Vault Secrets User
Reads Key Vault secret contents and metadata. This includes the secret portion of a Key Vault certificate and, when that certificate key is exportable, can include its private key. The role cannot create, update, delete, recover, purge, or assign permissions and works only with Azure RBAC-enabled vaults.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 4633458b-17de-408a-b874-0445c86b69e6
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (2)
Microsoft.KeyVault/vaults/secrets/getSecret/actionMicrosoft.KeyVault/vaults/secrets/readMetadata/action
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign to the consuming workload identity at the individual vault. Parent assignments are inherited by child vaults. A secret-level assignment is supported for limited sharing scenarios, but Microsoft recommends a vault per application and environment as the normal security boundary.
Common use cases (2)
- Allow an application managed identity to retrieve passwords, connection strings, API keys, or other approved runtime credentials.
- Retrieve the secret representation of a certificate when the workload is explicitly authorized to consume that content.
Prerequisites (3)
- The vault must use Azure RBAC and the application must authenticate with an approved Microsoft Entra identity, preferably a managed identity.
- Identify exactly which vault or exceptional individual secret the workload needs and define its rotation and caching behavior.
- The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.
Best practices (3)
- Assign to a managed identity at one application-specific vault and avoid direct human assignments for routine application retrieval.
- Rotate secrets regularly, refresh caches on rotation, and enable logging and alerts for unusual or failed access.
- Do not store general configuration or customer content as secrets, and avoid certificate-secret access when the workload needs only the public certificate.
Security considerations (3)
- The role exposes live credential values that can be copied and used outside Key Vault until those credentials are rotated or revoked.
- Certificate secret content can include an exportable private key, which materially exceeds metadata-only certificate access.
- The role cannot change secret lifecycle state or permissions, but secret-content read access is still highly privileged.
Assignment guidance
Assign Key Vault Secrets User to the application managed identity at the application vault or exceptional secret scope. Use Key Vault Reader for Key Vault data-plane metadata inspection while accounting for its ancillary control-plane Actions, and use Secrets Officer for approved credential lifecycle administration.
Related roles (2)
- Key Vault Secrets Officer: Adds create, update, rotation, backup, restore, deletion, recovery, and purge operations for secrets.
- Key Vault Reader: Limits Key Vault data-plane access to metadata and cannot read secret contents, though its definition also includes classic-alert and support-ticket control-plane Actions.
Common questions
When should I assign the Key Vault Secrets User Azure role?
Assign Key Vault Secrets User when you need to: Allow an application managed identity to retrieve passwords, connection strings, API keys, or other approved runtime credentials.; and Retrieve the secret representation of a certificate when the workload is explicitly authorized to consume that content.. Practical scope: Assign to the consuming workload identity at the individual vault. Parent assignments are inherited by child vaults. A secret-level assignment is supported for limited sharing scenarios, but Microsoft recommends a vault per application and environment as the normal security boundary.
What permissions does the Key Vault Secrets User Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.KeyVault/vaults/secrets/getSecret/action; and Microsoft.KeyVault/vaults/secrets/readMetadata/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Key Vault Secrets User Azure role?
Key considerations when assigning Key Vault Secrets User: The role exposes live credential values that can be copied and used outside Key Vault until those credentials are rotated or revoked.; Certificate secret content can include an exportable private key, which materially exceeds metadata-only certificate access.; and The role cannot change secret lifecycle state or permissions, but secret-content read access is still highly privileged.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (8)
- Azure built-in roles for Security →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Steps to assign an Azure role →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.
- Grant permission to applications to access an Azure key vault using Azure RBAC →
Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Secure your Azure Key Vault →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.
- Secure your Azure Key Vault secrets →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.
- About Azure Key Vault certificates →
Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.