When making access policy for public cloud service principal, to whom the access is actually given?

Question

On the documentation here we are required to give access for "abfa0a7c-a6b6-4736-8310-5855508787cd for public Azure cloud environment" to KeyVault in order for App Services be able to access keyvault certificates.

If we give access to this principal what exactly are we giving rights to?

I am hoping it's not any app service in Azure.... I would assume it's only inside current tenant, but it doesn't come clear in the documentation.

Answer 1

Hi @Tero Niemi

Thank you for reaching Microsoft Q&A Forum!

When you grant access to the service principal "xxxxxx-xxxxx-xxxx-xxxxx-xxxx08787cd" for the Azure Key Vault, you are typically allowing it to perform specific actions such as reading secrets, certificates, or keys stored in the Key Vault.
The service principal will have the ability to read secrets and certificates from the Key Vault. This is essential for App Services to retrieve certificates for SSL/TLS bindings.
The access is generally limited to the Key Vault within the current Azure subscription and tenant. It does not grant access to other Azure resources or Key Vaults outside of this scope unless explicitly configured.

Hope this helps. Do let us know if you any further queries by responding in the comments section.

Thanks,

Akhilesh.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.