Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Key Vault access policy

Key Vault's legacy data-plane permission model. Principals with vaults/write (e.g. Contributor) can grant themselves secret access with it.

A Key Vault access policy grants a principal data-plane permissions — get, list, set… — on a vault's secrets, keys and certificates. It is the legacy alternative to Azure RBAC for Key Vault.

Microsoft warns that, with this model, anyone holding Contributor, Key Vault Contributor or another role with Microsoft.KeyVault/vaults/write can grant themselves data-plane access (Azure RBAC vs. access policies). Changes appear as Microsoft.KeyVault/vaults/accessPolicies/write in the Activity Log and VaultAccessPolicyChangedEventGridNotification in the Key Vault audit log.

See Key Vault audit logs: who read which secret.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.