Forum Discussion
Azure Inherited roles, but still access denied
Hi,
In e.g. Key Vault, when looking for the Access Control I can see that user account have custom contributor role inherited from the subscription level. When looking for the role more deeply it shows:
"Showing 500 of 15937 permissions View all (will take a moment to load)"
E.g. having the following permissions: Read Secret Properties and Write Secret. So all should be kind of okay..? 🙂
But when I'm looking for the e.g. secrets in the key vault, it gives me back "The operation is not allowed by RBAC." and "You are unauthorized to view these contents.". I thought there could be a "deny" rules, but nothing in there either.
What could be the trick on here? What might be blocking or missing the access to the resources.
Btw, I just tested, I was able to create the Key Vault by myself.
- It seems like your custom role has the necessary permissions, but Azure Key Vault might be blocking access due to missing Access Policies. Key Vault has its own access control separate from RBAC. Check the Access Policies in the Key Vault and ensure your user or group has the required secret permissions. Also, confirm if the role covers data plane actions like "read" and "write" secrets.
