Service with Owner level access unable to bind certificate in Keyvault

Question

I am trying to bind a certificate to an app service, but am receiving the following error

Failed to import Key Vault Certificate for testing-admin.airportcharges.com due to error: The service does not have access to '/subscriptions/xxxxxxxxxxxx/resourcegroups/q/providers/microsoft.keyvault/vaults/rdcvaulttesting' Key Vault. Please make sure that you have granted necessary permissions to the service to perform the request operation.

We have recently started transitioning to RBAC, so while not ideal, we have gone as far as giving the app service Owner level permissions on the Keyvault, but this has not made any difference. We are currently usure what resource requires authorisation and any help would be appreciated.The correlation ID I have is 6e81b5b3-4708-4647-9b3f-5476f92ad2d5

Answer 1

Hello @Mark Windle,

Based on your description, I understand that you are trying to add a private key certificate to your App Service by importing it from Azure Key Vault. However, while you can view the certificate, you encounter an error when clicking "Add," which states:

"The service does not have access to '/subscriptions/xxxxxxxxxxx/resourcegroups/keyvault/providers/microsoft.keyvault/vaults/rdcvaulttesting' Key Vault. Please make sure that you have granted the necessary permissions to the service to perform the request operation."

I faced the same issue while performing this action in my tenant.

After investigating, I found that the problem isn't with Azure Key Vault itself but with Azure App Services, which do not fully support RBAC. As per: Authorize App Service to read from the vault:

By default, the App Service resource provider doesn't have access to your key vault. To use a key vault for a certificate deployment, you must authorize read access for the resource provider to the key vault. Currently, a Key Vault certificate supports only the Key Vault access policy, not RBAC model.

To resolve this issue, you need to assign the "Key Vault Certificate User" role to the Microsoft Azure App Service application (Object ID: 3f975d5d-2ff4-415d-9dc8-84cab13db1d5) in your Key Vault’s IAM (Access Control) settings.

Authorize App Service to read from the vault

1. Navigate to Azure Key Vault → Access Control (IAM).
2. Click Add role assignment.
3. Select "Key Vault Certificate User" role and click Next.
4. Under Select members, search for Microsoft Azure App Service by name or enter the Object ID: 3f975d5d-2ff4-415d-9dc8-84cab13db1d5.
5. Click Review + Assign to complete the role assignment.

Once this is done, go back to App Service Certificates and try adding the private key certificate again. After following these steps, I was able to successfully import the certificate into my App Service from Key Vault.

I hope this information is helpful. Please feel free to reach out if you have any further questions. If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".