A lock-lab Key Vault still shows vault access policies, and an engineer also assigned Key Vault Secrets Officer through Azure RBAC. How should the security engineer treat the permission models?
Select an answer to reveal the explanation.
Short Explanation
Pick a lane: access policies or Azure RBAC for the data plane—not both at once. Flip the vault’s permission model to the one you want and stop mixing the dials.
Full Explanation
A Key Vault data plane is authorized with either the vault access policy model or Azure role-based access control, depending on the vault’s permission model setting. The models are mutually exclusive for authorization evaluation; enabling confusion by assuming they stack leads to broken or overly broad access. Microsoft documents Azure RBAC as the recommended and default model for new vaults on current API versions. Subscription Reader alone does not grant secret Get.