Key Vault built-in roles: Reader vs Certificate User vs Crypto Officer vs Crypto User
This sheet compares Key Vault Reader, Key Vault Certificate User, Key Vault Crypto Officer, Key Vault Crypto User, Key Vault Administrator.
| Criterion | Key Vault Reader | Key Vault Certificate User | Key Vault Crypto Officer | Key Vault Crypto User | Key Vault Administrator |
|---|---|---|---|---|---|
| Can do | View metadata across keys, secrets, certificates | Read complete certificate content including private key | Any key action except managing permissions | Cryptographic operations using keys | Every data-plane operation on all object types |
The verdict, the full comparison, 3 rules and 3 traps are part of SC-500 access. Unlock SC-500.