Azure Security built-in role

Key Vault Secrets User

Reads Key Vault secret contents and metadata. This includes the secret portion of a Key Vault certificate and, when that certificate key is exportable, can include its private key. The role cannot create, update, delete, recover, purge, or assign permissions and works only with Azure RBAC-enabled vaults.

Control-plane actions (0)

None — this role grants no control-plane management actions.

Data-plane actions (2)

• Microsoft.KeyVault/vaults/secrets/getSecret/action
• Microsoft.KeyVault/vaults/secrets/readMetadata/action

Excluded actions (0)

None

Assignable scopes (1)

• /

Practical scope

Assign to the consuming workload identity at the individual vault. Parent assignments are inherited by child vaults. A secret-level assignment is supported for limited sharing scenarios, but Microsoft recommends a vault per application and environment as the normal security boundary.

Common use cases (2)

• Allow an application managed identity to retrieve passwords, connection strings, API keys, or other approved runtime credentials.
• Retrieve the secret representation of a certificate when the workload is explicitly authorized to consume that content.

Prerequisites (3)

• The vault must use Azure RBAC and the application must authenticate with an approved Microsoft Entra identity, preferably a managed identity.
• Identify exactly which vault or exceptional individual secret the workload needs and define its rotation and caching behavior.
• The assigning administrator needs Microsoft.Authorization/roleAssignments/write at the target scope.

Best practices (3)

• Assign to a managed identity at one application-specific vault and avoid direct human assignments for routine application retrieval.
• Rotate secrets regularly, refresh caches on rotation, and enable logging and alerts for unusual or failed access.
• Do not store general configuration or customer content as secrets, and avoid certificate-secret access when the workload needs only the public certificate.

Security considerations (3)

• The role exposes live credential values that can be copied and used outside Key Vault until those credentials are rotated or revoked.
• Certificate secret content can include an exportable private key, which materially exceeds metadata-only certificate access.
• The role cannot change secret lifecycle state or permissions, but secret-content read access is still highly privileged.

Assignment guidance

Assign Key Vault Secrets User to the application managed identity at the application vault or exceptional secret scope. Use Key Vault Reader for Key Vault data-plane metadata inspection while accounting for its ancillary control-plane Actions, and use Secrets Officer for approved credential lifecycle administration.

Related roles (2)

• Key Vault Secrets Officer: Adds create, update, rotation, backup, restore, deletion, recovery, and purge operations for secrets.
• Key Vault Reader: Limits Key Vault data-plane access to metadata and cannot read secret contents, though its definition also includes classic-alert and support-ticket control-plane Actions.

Editorial sources (8)

• Azure built-in roles for Security →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Steps to assign an Azure role →

  Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Best practices, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices, Assignment guidance. Retrieved 2026-07-16.

• Grant permission to applications to access an Azure key vault using Azure RBAC →

  Supports: Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Secure your Azure Key Vault →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

• Secure your Azure Key Vault secrets →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

• About Azure Key Vault certificates →

  Supports: Common use cases, Prerequisites, Best practices, Security considerations. Retrieved 2026-07-16.

Official Microsoft Learn documentation →