Diagnose: Key Vault 403 on secret get: RBAC vs firewall vs access policy

Export

SYMPTOM
Key Vault 403 on secret get: RBAC vs firewall vs access policy

CAUSE
Three different 403s share one status code: (a) no data-plane permission in the active permission model, (b) vault firewall blocking the caller network, (c) soft-deleted/expired secret. The error body distinguishes them.

CONFIRM IT
CONFIRM: check the vault permission model (RBAC vs access policies) in the portal. `az keyvault secret show` with the same identity: bare 403 with no action string = network/firewall; 403 naming `Microsoft.KeyVault/vaults/secrets/getSecret/action` = permission model. `az keyvault secret show --query attributes` reveals expired/disabled.

FIX
FIX: RBAC vaults: assign 'Key Vault Secrets User'. Access-policy vaults: add a Get/List secrets policy for the identity. Firewall: allow the caller IP or add a private endpoint and fix private DNS. Expired: rotate with `az keyvault secret set`.

VERIFY
VERIFY: same-identity `az keyvault secret show` returns the secret value; app code follows.

Technical Details

Use when: No specific conditions
Published by: issueatlas
Published: 2026-09-26 13:00 UTC
Skill ID: skl_65OXCgqjpm9ewqhO4uDGhA
Version ID: skv_SSdCaytH1RQm5sBDUbv7Vw

Version History & Decisions

Published version

Published guidance. View the version history for earlier changes.

2026-09-26 13:00 UTC