An engineer flips the lock-lab Key Vault permission model to Azure role-based access control and every application immediately loses secret access. What order should the security engineer have followed?
Select an answer to reveal the explanation.
Short Explanation
Seat the RBAC roles first, then flip the permission model—don’t cut over cold. After apps can still Get secrets, sweep the leftover access policies off the vault.
Full Explanation
When migrating from access policies to Azure RBAC, existing policy-based grants stop authorizing data-plane calls after the model switch. Assigning Key Vault data-plane roles first preserves access through the cutover, after which obsolete access policies should be removed. Access policies do not stack with the RBAC model. Disabling Entra ID or recreating the vault without roles does not implement a controlled migration. PIM can wrap Azure RBAC roles later; it cannot wrap classic access policies.