how to understand azure key vault access policy?

Question

hi friend,

i have create a service principal, a azure key vault, a secret scope called A and B under AKV .

now i have grant get/list...permission to that service principal through access principal. it's mean that service principal can access both secret A and B?

How does a similar situation affect the Key scope?

Thanks!

Answer 1

When you grant an Azure Key Vault access policy to a service principal, it typically allows the principal to perform specified actions across all secrets or keys within the Key Vault, unless otherwise restricted by more granular permissions. In your case, if you have granted 'get' and 'list' permissions to the service principal, it means this principal can indeed access both Secret Scope A and B, as well as any other secrets present in the Key Vault. This access is not limited to specific secrets unless you explicitly define narrower scope restrictions, which Azure Key Vault currently does not support at the secret level (that I know of); access policies are applied at the vault level. Therefore, granting these permissions allows the service principal to interact with all secrets within the vault as specified by the assigned permissions.