Azure Key Vault: Access Denied

Azure key vault: access denied

To fix access denied you need to configure Active Directory permissions. Grant access to KeyVault.

1. Using PowerShell
Run next command:

Set-AzureRmKeyVaultAccessPolicy -VaultName 'XXXXXXX' -ServicePrincipalName XXXXX -PermissionsToKeys decrypt,sign,get,unwrapKey

2. Using the Azure portal

Open Key Vaults
Select Access Policies from the Key Vault resource blade
Click the [+ Add Access Policy] button at the top of the blade
Click Select Principal to select the application you created earlier
From the Key permissions drop down, select "Decrypt", "Sign", "Get", "UnwrapKey" permissions
Save changes

Authorize the application to use the key or secret

“Key vault access denied” in azure web app configuration setting

The error means the managed identity of your web app does not have permission to access the keyvault secret, if you create the keyvault with the azure CLI in the blog, make sure you use the --enable-rbac-authorization parameter.

az keyvault create --resource-group securebackendsetup --name securekeyvault2021 --location westeurope --sku standard --enable-rbac-authorization

And have assigned the Key Vault Secrets User to the managed identity.

az webapp identity assign --resource-group securebackendsetup --name securebackend2021 --scope $kv_resource_id --role  "Key Vault Secrets User"

If you are using a keyvault created before, make sure the Azure role-based access control was selected in the keyvault as below in the portal.

enter image description here

Then assign the managed identity of the web app to the keyvault as the Key Vault Secrets User role, you can find the <managed-identity-objectId> in your web app -> Identity in the portal.

az role assignment create --role "Key Vault Secrets User" --assignee-object-id <managed-identity-objectId> --scope $kv_resource_id

Access Denied when accessing Azure Key vault from Azure Functions

You need to enable the Get secret permission on this policy.

There is the doc about granting your app access to Key Vault.

Azure Key Vault - Access denied

Please refer to this link.

objectId string Yes The object ID of a user, service principal or
security group in the Azure Active Directory tenant for the vault. The
object ID must be unique for the list of access policies.

You could find the object id on Enterprise applications - All applications not App registrations.

enter image description here

You also could get the object id with Power Shell.

Get-AzureADServicePrincipal

The root reason is that when you register an Azure AD application in the Azure portal, two objects are created in your Azure AD tenant: an application object, and a service principal object.

Application object

An Azure AD application is defined by its one and only application
object, which resides in the Azure AD tenant where the application was
registered, known as the application's "home" tenant. The Azure AD
Graph Application entity defines the schema for an application
object's properties.

Service principal object

The service principal object defines the policy and permissions for an
application's use in a specific tenant, providing the basis for a
security principal to represent the application at run-time. The Azure
AD Graph ServicePrincipal entity defines the schema for a service
principal object's properties.

More information about this please refer to this link.

How can I identify what the first party service is when failing to authenticate to Azure KeyVault?

Tenant f8cdef31-a31e-4b4a-93e4-5f571e91255a is a special tenant where Microsoft first party applications are defined. Certain ARM and Compute scenarios access Key Vault using tokens from this tenant, but in general Key Vault rejects tokens from this tenant and it is not available for use by customers.

The tenant you should use is the one that shows up under "Tenant ID" when you look at the "Azure Active Directory" section in the Azure Portal. Personal accounts, such as outlook.com accounts, can get tokens issued by the first party tenant if they do not specify their own tenant ID. Organization accounts get tokens from their home tenant based on the verified domains associated with the tenant, so they generally do not need to specify a tenant ID explicitly.