AZ-104 Practice Question 62: Key Vault RBAC Permission Model
Microsoft Azure Administrator Associate (AZ-104) · Test 7 · question 2 of 10
A team currently controls access to an Azure Key Vault with vault access policies. The security team now requires that access to individual secrets be granted through the same Azure RBAC model used for other resources, with roles assigned at the scope of a single secret and administrators using Privileged Identity Management for eligible role assignments.
What should the administrator do?
Show answer and explanation
Answer:
A Key Vault has one of two permission models for its data plane. With Azure RBAC, built-in roles such as Key Vault Secrets User or Key Vault Administrator are assigned like any other role, at the scope of a management group, subscription, resource group, vault, or an individual secret, key or certificate. Because these are ordinary role assignments, PIM can make them eligible and time bound.
Option B is not possible. An access policy applies to the whole vault; there is no per-secret access policy, so it cannot deliver the requested granularity.
Option C would give no access to secrets. The Reader role covers management plane reads such as listing the vault; it does not include data plane permissions to read secret values.
Option D does not work either. PIM manages role assignments in Entra ID and Azure RBAC, and vault access policies are not roles that can be made eligible.
Reference: Provide access to Key Vault keys, certificates, and secrets with Azure role-based access control