Description:

Azure Key Vault supports two authorization models: Access Policies and Azure RBAC. Access Policies are legacy and provide limited permission management, whereas Azure RBAC provides centralized, consistent, and scalable identity and access control. Enabling Azure RBAC ensures Key Vault permissions are managed using standard Azure roles at the subscription, resource group, or resource level. This control verifies that Key Vault is configured to use Azure role-based authorization instead of Access Policies to support enterprise security, governance, and least-privilege access.


Rationale:

This rule checks whether the Key Vault has the permission model set to Azure RBAC authorization. If the Key Vault continues using Access Policies, it is marked NON_COMPLIANT. The RBAC model eliminates fragmented access configuration, improves auditability, supports Conditional Access, integrates with PIM for just-in-time elevation, and aligns with Microsoft best practices for secure identity management.


Impact:

  • Centralized and simplified identity access management.

  • Supports enterprise compliance and least-privilege requirements.

  • Eliminates fragmented access behavior caused by Access Policies.

  • Enables Conditional Access and advanced identity governance frameworks like PIM/JIT.


Default Value:

Key Vaults created before 2021 often default to Access Policies. Key Vaults created after 2021 may default to RBAC, but this is not guaranteed. Many deployments still require manual switching to RBAC.


Pre-requisites:

  • Permission to modify Key Vault configuration

  • Permission to assign Azure RBAC roles

  • Applications interacting with Key Vault support Azure RBAC


Test Plan:

  1. Sign in to the Azure Portal at https://portal.azure.com

  2. Navigate to Key Vaults and select the applicable Key Vault.

  3. Under settings, Open Access configuration.

  4. Verify that the permission model is set to Azure role-based access control.

  5. If it is not set to  Azure role-based access control, follow the implementation steps

Implementation Steps:

  1. Sign in to the Azure Portal at https://portal.azure.com

  2. Navigate to Key Vaults and select the required Key Vault.

  3. Under settings, Open Access configuration.

                                  

  1. Set the permission model to Azure role-based access control.

  1. Save the configuration.


Backout Plan:

  1. Sign in to the Azure Portal at https://portal.azure.com

  2. Navigate to Key Vaults and select the affected Key Vault.

  3. Open Access configuration.

  4. Change the permission model to Vault access policy.

  5. Re-create the required access policies.

  6. Save the configuration.


Reference: