Azure KeyVault left with stale reference in access policies

Question

I assign an access policy for a managed identity to a keyvault via ARM template. When the identity is deleted, the access policy is NOT removed automatically from the KV and so a stale reference is left behind. Is this expected? Shouldn't the reference get removed when the referencing object gets deleted?

Answer 1

@TejasShah-0762
This is expected behavior. As stated within our Managed Identities documentation "Deleting a user assigned identity does not remove it from the VM or resource it was assigned to...". I was able to test this out with a Managed Identity for Azure Resources, namely a VM, and found that this had to be manually deleted also.

Findings:
In the below screenshot, I deleted the User Managed Identity from the actual "Managed Identities" page in the Azure Portal. I waited 5 minutes and the Identity was still in the Key Vault. Even after a "refresh" as seen at the top of the screenshot.

In this screenshot, I added my VM's system-assigned managed identity, deleted the VM and Resource Group, waited a few minutes to see if the Key Vault would update, and it didn't.

Since this looks to be a "by-design" type of issue, please feel free to submit a feature request using the User voice/General Feedback link.

Please let me know if you have any other questions.
Thank you for your time and patience!

---

If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.