Two-Layer Azure Key Vault Access Control

Access to the vault is governed by two layers: Azure AD role-based access control (RBAC) for management operations and the vault’s own access policy for data operations. Use Azure AD roles (such as Key Vault Contributor) to control who can create or delete vaults and set firewall rules. Use a Key Vault access policy to define exactly which users, groups, or applications can perform operations on secrets, keys, or certificates—for example, Get or Set on secrets. This two-layer approach lets you enforce the least privilege principle: a security admin might get management access to configure the vault, while an application’s managed identity gets only the data-plane permissions needed to read its own secret. No identity ever inherits more than what the policy explicitly grants.