Azure Key Vault 403 Forbidden: access policies vs RBAC, firewalls and soft delete

#1. Which permission model does the vault use?

az keyvault show -n kv-prod --query "{rbac:properties.enableRbacAuthorization, publicAccess:properties.publicNetworkAccess, defaultAction:properties.networkAcls.defaultAction, softDelete:properties.enableSoftDelete, purgeProtection:properties.enablePurgeProtection}" -o table

• rbac: true → access policies are ignored. Grant Azure RBAC data roles.
• rbac: false → only access policies count for data-plane access. RBAC data roles have no effect.

This mismatch causes most "but I gave it permissions!" tickets.

#2a. RBAC vaults: assign a data role

PRINCIPAL=$(az webapp identity show -g rg-web -n app-prod --query principalId -o tsv)
az role assignment create --assignee-object-id $PRINCIPAL --assignee-principal-type ServicePrincipal \
  --role "Key Vault Secrets User" --scope $(az keyvault show -n kv-prod --query id -o tsv)

#2b. Access-policy vaults

az keyvault set-policy -n kv-prod --object-id $PRINCIPAL --secret-permissions get list

Use the object ID of the managed identity or service principal, not the application (client) ID.

#3. Firewall and private endpoint

An error such as Client address is not authorized and caller is not a trusted service means the request was blocked by the network rules, not by permissions.

• Add the caller's public IP, VNet or subnet, or use a private endpoint.
• Allow trusted Microsoft services if Azure services (for example Backup or App Service Key Vault references) need to reach the vault.

#4. App Service and Functions Key Vault references

A setting like @Microsoft.KeyVault(SecretUri=...) that shows a red error in the portal usually means:

• The identity lacks Secrets User (RBAC) or get (access policy).
• The vault firewall blocks the app's outbound IPs. Use VNet integration plus a private endpoint, or set keyVaultReferenceIdentity.
• The secret URI points to a version that has been disabled.

#5. "Vault name already exists" or "secret is in a deleted state"

Soft delete keeps deleted vaults and secrets for 7–90 days.

az keyvault list-deleted -o table
az keyvault recover -n kv-prod                      # bring the vault back
az keyvault secret recover --vault-name kv-prod -n db-password

Warning

With purge protection on, deleted items can't be purged until the retention period ends, by design. Use a new vault or secret name if you can't wait.

#Prevent it next time

• Standardize on RBAC for new vaults, and assign roles in IaC alongside the app.
• Send vault diagnostics to Log Analytics and alert on spikes of ResultSignature == "Forbidden" in AzureDiagnostics.