not able to change access configuration policy

himani ghildiyal 5 Reputation points
2023-10-19T05:18:01.9833333+00:00

CODE

InsufficientPermissions

MESSAGE

RAW ERROR

Caller is not allowed to change permission model. For more information on how to change the permissions model follow this link: https://go.microsoft.com/fwlink/?linkid=2155160. Details: name=live.com#himani786786@gmail.com; oid=b07e2451-9254-439a-bd94-32c3cebb085b; action=Microsoft.Authorization/roleAssignments/write; resource=/subscriptions/d7dad398-d1ca-4b8d-a1e3-e8bedbbc576f/resourcegroups/ghimani/providers/Microsoft.KeyVault/vaults/connectionstringdb1; decision=NotAllowed;

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,171 questions
Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
708 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vinodh247-1375 12,506 Reputation points
    2023-10-19T06:55:49.2566667+00:00

    Hi himani ghildiyal:

    Thanks for reaching out to Microsoft Q&A.

    You should have Key Vault Data Access Administrator, User Access Administrator or Owner permissions to change access configuration policy. Could you double check that?

    Changing permission model requires 'Microsoft.Authorization/roleAssignments/write' permission, which is part of Owner and User Access Administrator roles. Classic subscription administrator roles like 'Service Administrator' and 'Co-Administrator' are not supported.

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    1 person found this answer helpful.
  2. David MATTON 0 Reputation points
    2024-06-25T12:49:22.81+00:00

    Same error here with Terraform.

    With Terraform and a service principal, I created a Key Vault with Access policy. No problem, everything is OK. I decided to enable rbac, and I have the same error.

    The service principal has "Contributor", "User Access Administrator" roles. But the error is still here.

    0 comments