# Ensue Role Based Access Control permission model is Enabled for Azure Key Vault

- Source: https://support.icompaas.com/support/solutions/articles/62000229880-ensue-role-based-access-control-permission-model-is-enabled-for-azure-key-vault
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-06-15
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Azure Key Vault supports two authorization models: Access Policies and Azure RBAC. Access Policies are legacy and provide limited permission management, whereas Azure RBAC provides centralized, consistent, and scalable identity and access control. Enabling Azure RBAC ensures Key Vault permissions are managed using standard Azure roles at the subscription, resource group, or resource level. This control verifies that Key Vault is configured to use Azure role-based authorization instead of Access Policies to support enterprise security, governance, and least-privilege access.

  

Rationale:

This rule checks whether the Key Vault has the permission model set to Azure RBAC authorization. If the Key Vault continues using Access Policies, it is marked NON\_COMPLIANT. The RBAC model eliminates fragmented access configuration, improves auditability, supports Conditional Access, integrates with PIM for just-in-time elevation, and aligns with Microsoft best practices for secure identity management.

  

Impact:

-   Centralized and simplified identity access management.
    
-   Supports enterprise compliance and least-privilege requirements.
    
-   Eliminates fragmented access behavior caused by Access Policies.
    
-   Enables Conditional Access and advanced identity governance frameworks like PIM/JIT.
    

  

Default Value:

Key Vaults created before 2021 often default to Access Policies. Key Vaults created after 2021 may default to RBAC, but this is not guaranteed. Many deployments still require manual switching to RBAC.

  

Pre-requisites:

-   Permission to modify Key Vault configuration
    
-   Permission to assign Azure RBAC roles
    
-   Applications interacting with Key Vault support Azure RBAC
    

  

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Navigate to Key Vaults and select the applicable Key Vault.
    
3.  Under settings, Open Access configuration.
    
4.  Verify that the permission model is set to Azure role-based access control.
    
5.  If it is not set to  Azure role-based access control, follow the implementation steps
    

Implementation Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Navigate to Key Vaults and select the required Key Vault.
    
3.  Under settings, Open Access configuration.
    

4.  Set the permission model to Azure role-based access control.
    

5.  Save the configuration.
    

  

Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Navigate to Key Vaults and select the affected Key Vault.
    
3.  Open Access configuration.
    
4.  Change the permission model to Vault access policy.
    
5.  Re-create the required access policies.
    
6.  Save the configuration.
    

  

Reference:

-   [https://learn.microsoft.com/azure/key-vault/general/rbac-guide](https://learn.microsoft.com/azure/key-vault/general/rbac-guide)
    
-   [https://learn.microsoft.com/azure/key-vault/general/secure-your-key-vault](https://learn.microsoft.com/azure/key-vault/general/rbac-guide)
    
-   [https://learn.microsoft.com/azure/security-benchmark/azure-security-benchmark-identity-management](https://learn.microsoft.com/azure/key-vault/general/rbac-guide)
    
-   [https://learn.microsoft.com/azure/governance/policy/samples/cis-azure-1-3-0](https://learn.microsoft.com/azure/key-vault/general/rbac-guide)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.