Key Vault uses Azure RBAC for access control

Check ID: keyvault_rbac_enabled
Provider: Azure
Service: keyvault
Severity: HIGH
Categories: identity-access
Resource type: microsoft.keyvault/vaults

What this check verifies

Azure Key Vault uses the Azure RBAC permission model for data-plane access to keys, secrets, and certificates, rather than legacy access policies. Evaluates whether data access is managed through role assignments at the vault.

Risk

Without Azure RBAC, data access relies on coarse access policies. Control-plane Contributors can grant themselves data-plane rights, enabling secret or key exfiltration and unauthorized crypto operations. Lack of JIT and least-privilege weakens confidentiality and integrity and hinders auditing.

Recommendation

Adopt Azure RBAC for Key Vault data access and design roles with least privilege at appropriate scopes (prefer vault-level per app/env). Use Privileged Identity Management for JIT, restrict control-plane Contributor rights, and monitor role assignments. Role assignments aren’t preserved after soft-delete recovery.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az keyvault update —name <KEY_VAULT_NAME> —resource-group <RESOURCE_GROUP_NAME> —enable-rbac-authorization true

resource "azurerm_key_vault" "<example_resource_name>" {
  name                       = "<example_resource_name>"
  location                   = "<location>"
  resource_group_name        = "<example_resource_name>"
  tenant_id                  = "<tenant_id>"
  sku_name                   = "standard"
  enable_rbac_authorization  = true // Critical: enables Azure RBAC to satisfy the control
}

// Enable Azure RBAC on a Key Vault
resource kv 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  properties: {
    tenantId: '<tenant_id>'
    enableRbacAuthorization: true // Critical: switches permission model to Azure RBAC to pass the check
    sku: {
      family: 'A'
      name: 'standard'
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = keyvault_rbac_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Key Vault uses private endpoints Key in RBAC-enabled Key Vault has expiration date set

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires