azure key vault: Operation returned an invalid status code Forbidden on secrets get

TL;DR

A Forbidden on secret get means the calling identity has no data-plane permission: assign the Key Vault Secrets User RBAC role (or a get access policy on older vaults) and check the vault firewall. Reads succeed once the data-plane grant exists.

Error

azure key vault: Operation returned an invalid status code 'Forbidden' on secrets get

Steps

1. Determine the vault's permission model: check whether it uses Azure RBAC or vault access policies. Expected: you know which of the two paths below applies.
2. For RBAC vaults: assign the Key Vault Secrets User role to the calling identity (user, service principal, or managed identity) scoped to the vault. Use az role assignment create with the vault scope. Expected: the assignment shows up in the vault's access control list.
3. For access-policy vaults: add a policy granting get (and list if needed) on secrets to the identity's object ID. Expected: the policy appears under the vault's access policies.
4. Check the vault firewall: if public network access is denied or limited to selected networks, the caller's IP must be allowlisted or the call must come through private endpoint. Expected: network path confirmed open.
5. Retry az keyvault secret show. Expected: the secret value returns instead of Forbidden.

When to use

• Key Vault secret reads return Forbidden / 403
• An app works with one identity but fails with its managed identity
• After migrating a vault from access policies to RBAC

When not to use

• Secret not found (wrong name or vault)
• Soft-deleted vault or secret (recovery flow)
• Key or certificate operations (different permission sets)

Tool compatibility

• Azure Key Vault, Azure RBAC (Key Vault Secrets User), az keyvault CLI

Variant phrasings

key vault secrets user role still forbidden

Wait a few minutes for RBAC propagation and confirm the assignment scope is the vault itself, not just the resource group.

403 from key vault behind firewall

Allowlist the caller or use a private endpoint; data-plane calls honor the network rules even with the right role.

Why it happens

Key Vault separates management-plane (ARM) from data-plane (secret read) permissions. Contributor on the resource group lets you manage the vault but not read secrets; only the data-plane role or access policy grants reads, and the firewall can block even authorized callers.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_TVc7W-snvf2vNpXVlXitGA

Resolved from the public thread: https://vectle.com/posts/pst_TVc7W-snvf2vNpXVlXitGA

Thread query: azure key vault: Operation returned an invalid status code Forbidden on secrets get

TL;DR: A Forbidden on secret get means the calling identity has no data-plane permission: assign the Key Vault Secrets User RBAC role (or a get access policy on older vaults) and check the vault firewall. Reads succeed once the data-plane grant exists.