Share via

Action required: Transition Azure Key Vault access policies to Azure RBAC or configure Azure Key Vault to explicitly use access policies

Altaf Ingar 100 Reputation points
2026-02-05T21:55:19.37+00:00

i got this email but i am bit confused and need your support via screenshare session.

Transition to Azure RBAC

You’re receiving this email because you’re using Azure Key Vault. On 27 February 2027, all Azure Key Vault API versions prior to 2026-02-01 will be retired. Azure Key Vault API version 2026-02-01—releasing in February 2026—[introduces an important security update__**Azure role-based access control (RBAC) will be the default access control model for all newly created vaults.__ Existing key vaults will continue using their current access control model. Azure portal behavior will remain unchanged. If you’re using legacy access policies for new and existing vaults, we recommend [migrating to Azure RBAC] as the access control model in your CLI, PowerShell, Rest API, ARM, Bicep, and Terraform templates. If you don’t take this action, all newly created vaults will be created with Azure RBAC as the default access control model, which can result in HTTP 403 errors and failures in your code and operations due to missing roles.

Azure App Configuration
Azure App Configuration

An Azure service that provides hosted, universal storage for Azure app configurations.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Siddhesh Desai 3,935 Reputation points Microsoft External Staff Moderator
    2026-02-05T22:02:09.0233333+00:00

    Hi @Altaf Ingar

    Thank you for reaching out to Microsoft Q&A.

    Yes, you can be 100% confident on this point.

    Adding new secrets, updating secrets, rotating certificates, importing or renewing certificates in existing Key Vaults that use legacy access policies is NOT impacted by this change, as long as the vault itself is not recreated or switched to Azure RBAC.

    The confusion is caused by Microsoft retiring older Azure Key Vault API versions (prior to 2026-02-01) on 27 February 2027 and introducing Azure RBAC as the default access control model for newly created Key Vaults starting with API version 2026-02-01. This change often raises concerns about whether existing Key Vaults using legacy access policies will stop functioning. However, the change does not alter the behavior of existing Key Vaults. Vaults that are already created will continue to operate with their current access configuration. Day‑to‑day data‑plane operations—such as adding new secrets, updating secrets, managing keys, or renewing certificates—are unaffected unless the vault is recreated or explicitly migrated to Azure RBAC. Problems typically occur only when new vaults are created or when infrastructure templates unintentionally default to RBAC, resulting in access‑denied (HTTP 403) errors due to missing role assignments. Existing vault usage remains supported and stable.

    Refer below points to resolve this issue or this is the workaround:

    No change required for existing Key Vaults using access policies All existing Key Vaults will retain their current access control model. You can continue adding or updating secrets and certificates without interruption, provided the vault is not deleted, recreated, or reconfigured.

    Explicit configuration required only for new Key Vault creation If new Key Vaults are created using ARM, Bicep, Terraform, Azure CLI, or PowerShell with API version 2026-02-01 or later, access policies must be explicitly enabled (enableRbacAuthorization = false) if RBAC is not desired. Otherwise, RBAC will be applied by default.

    Azure RBAC migration can be planned later (recommended but optional) Microsoft recommends migrating to Azure RBAC for improved security and centralized access management, but this is not mandatory for existing vaults. Migration can be scheduled independently without impacting current operations.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.