Key Vault RBAC vs access policy model, and the Contributor escalation path
This sheet compares Azure RBAC model, Access policy model, Contributor role, Key Vault firewall, Resource lock.
| Criterion | Azure RBAC model | Access policy model | Contributor role | Key Vault firewall | Resource lock |
|---|---|---|---|---|---|
| Grants data access how | Per key, secret or certificate via role assignment | Whole-vault only, via access policy entries | Control-plane only, no data by itself | Nothing; network reachability control | Nothing; blocks deletion or changes |
The verdict, the full comparison, 4 rules and 2 traps are part of SC-500 access. Unlock SC-500.