Azure Key Vault secrets in Python: vault URL plus data-plane role

TL;DR

New vaults use Azure RBAC: assign "Key Vault Secrets User" (get/list) or "Key Vault Secrets Officer" (manage). Old vaults use access policies: the identity needs Get/List on secrets.

Steps

1. ```python

from azure.identity import DefaultAzureCredential from azure.keyvault.secrets import SecretClient

client = SecretClient( vaulturl="https://YOUR-VAULT.vault.azure.net/", credential [your value] ) secret value client.getsecret("[secret-name]") print(secret.value)

2. - **Two permission models.** New vaults use Azure RBAC: assign "Key Vault Secrets User" (get/list) or "Key Vault Secrets Officer" (manage). Old vaults use access policies: the identity needs Get/List on secrets. A 403 means you are in one model and granted in the other. Check the vault's permission model in the portal first.
- **Firewall.** Vaults with firewall rules deny public network access by default. From a locked-down VNet you need a private endpoint; from your laptop you need your IP allow-listed or "allow trusted services" for the Azure service calling.
- **Soft delete + purge protection.** Deleted secrets go to soft-delete for 90 days. Recreating with the same name before purge gives a conflict. `az keyvault secret purge` if you really need the name back, or wait.
- **Secret versioning.** `get_secret` without a version returns the latest ENABLED version. Disabled versions are skipped silently; if rotation disabled the newest version, you get the older one with no error.
- **Do not print secrets.** Obvious, but agents do it in debug logs. Read into memory, use, never log.

3. Verify: `az keyvault secret show --vault-name [vault] --name [secret-name]` with the same identity your code uses. If the CLI works and the code 403s, the code is using a different identity (chain order problem).

## When to use

You are seeing this: ``python from azure.identity import DefaultAzureCredential from azure.keyvault.secrets import SecretClient client = SecretClient( vault\_url="https://YOUR-VAULT.vault.azure.net/", credential [your value] ) secret value... Use this skill when you run into "Azure Key Vault secrets in Python: vault URL plus data-plane role".

## When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

## Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

## Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

## Sources

- https://YOUR-VAULT.vault.azure.net/"

Proactive skill. SecretClient pattern and RBAC vs access-policy models verified against current docs. Evidence: https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-python