A subscription Contributor opened the lock-lab Key Vault and added themselves Get, List, and Set through an access policy. Why does Microsoft recommend Azure RBAC over access policies for this risk, and what is the mitigation direction?
Select an answer to reveal the explanation.
Short Explanation
With access policies, vault write is basically “make yourself a keyholder.” That’s why Microsoft steers you to Azure RBAC and skinny control-plane roles—so Contributor can’t quietly mint Get/List/Set for themselves.
Full Explanation
Under the access-policy permission model, control-plane permission to update the vault (Microsoft.KeyVault/vaults/write) can be used to modify access policies and grant data-plane rights. That classic privilege-escalation path is a primary reason Microsoft recommends the Azure RBAC permission model paired with least-privilege control-plane assignments. Security Copilot is out of scope for AZ-500 Key Vault access design. Relocating secrets does not remove the need for a sound Key Vault authorization model.