permissions in the key vault access

Question

permissions in the key vault access

Hariharan Viswanath 40

i am getting an error in the production environment as:

{
    "status": 401,
    "message": "Operation failed because client does not have permission to perform the operation on the key vault. Please check your permissions in the key vault access policies https://docs.microsoft.com/en-us/azure/key-vault/general/assign-access-policy-portal.\r\nclientRequestId: 6d430217-4bdd-4446-8c63-e5f029d3e8d8",
    "error": {
        "message": "Operation failed because client does not have permission to perform the operation on the key vault. Please check your permissions in the key vault access policies https://docs.microsoft.com/en-us/azure/key-vault/general/assign-access-policy-portal."
    },
    "source": "keyvault-eus2.azconn-eus2-002.p.azurewebsites.net"
}

Accepted answer

1 additional answer

Your answer

Answer 1

Kancharla Saiteja 3,565 Microsoft External Staff

Hi @Hariharan Viswanath,

Since you have provided Key vault administrator to a Managed identity, please check the description here: Perform all data plane operations on a key vault and all objects in it, including certificates, keys, and secrets. Cannot manage key vault resources or manage role assignments. Only works for key vaults that use the 'Azure role-based access control' permission model.

As specified, role cannot manage key vault resources or role assignments. Please make sure you are not performing the operations which are not in scope. Also, please check the following document for clear description: Azure built-in roles for Key Vault data plane operations.

If this document does not help you, let me know what the operation is you are trying to perform and which model of access (RBAC or Access policies) used.

Hariharan Viswanath 40 Reputation points

2025-04-14T20:17:28.8066667+00:00

We are trying to get a Secret value from the vault into the Logic App using a User-Assigned Managed Identity. It is RBAC only. It still does not work in the Production environment but works in the Development environment.
Kancharla Saiteja 3,565 Reputation points Microsoft External Staff

2025-04-14T21:42:14.31+00:00

Hi @Hariharan Viswanath,

Could you please check this document from community: User-assigned Managed Identity in Logic Apps Standard which might help you in re checking your configuration. Also please share the configure steps you performed in development and production to verify what step might be missing. Please share the configuration information in private chat.
Kancharla Saiteja 3,565 Reputation points Microsoft External Staff

2025-04-17T18:17:49.5766667+00:00

Hi @Hariharan Viswanath

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Kancharla Saiteja 3,565 Reputation points Microsoft External Staff

2025-04-18T16:33:25.8966667+00:00

Hi @Hariharan Viswanath

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hariharan Viswanath 40 Reputation points

2025-04-21T17:02:39.67+00:00

Adding a new API connection to the Managed Identity in Prod worked.

Answer 2

This error message indicates that the client (your application or managed identity) is attempting to access a Key Vault, but it lacks the necessary permissions.

To fix this, use the following procedure:

1. Determine which identity is being used

If it's a Managed Identity, identify whether it's a System-assigned or User-assigned Managed Identity.
If it's an App Registration (client ID/secret or certificate), ensure it's the correct one.

2. Assign the correct permissions to the Key Vault

There are two ways to grant access to a Key Vault:

Option A: Access Policies (for Vaults using the 'Vault access policy' permission model)

Go to the Key Vault in the Azure portal.
Under Access policies, click + Add Access Policy.
Choose the appropriate secret, key, or certificate permissions (depending on what the app needs).
Select the principal (your managed identity or app registration).
Click Add, then Save.

Option B: Role-Based Access Control (RBAC) (for vaults using the 'Azure role-based access control' model)

Go to the Key Vault.
Click Access Control (IAM).
Click + Add > Add role assignment.
Choose a role such as:
- Key Vault Reader
- Key Vault Secrets User
- Key Vault Administrator
Assign it to your app registration or managed identity.
Save the changes.

3. Wait a few minutes, then retry the operation — role assignments can take a short time to propagate.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Hariharan Viswanath 40 Reputation points

2025-04-14T18:03:20.16+00:00

The "Key Vault Administrator" is provisioned for the Managed Identity:

Do we need to add the other 2 - Key Vault Reader, Key Vault Secrets User roles as well to the Managed Identity? These were not assigned in the development environment and the access works fine.
Marcin Policht 44,850 Reputation points MVP

2025-04-14T19:29:28.59+00:00

If you are performing data plane operations, then Key Vault Administrator should suffice.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Share via

permissions in the key vault access

1 additional answer

Your answer