This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(195.2, 46%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Hi
I have encountered some problems when using Azure Key Vault.
The Problem:
I cannot create keys in Azure Key Vault, either a Key Vault key or a Key Vault key with HSM protection.
Some try:
I have checked that I am a privileged contributor within the subscription with this Key Vault account I created. I also asked our account owner to create keys in Key Vault, and he failed as me. Thus, I think it is not a permission problem.
My question is, what might cause this, and how can it be solved? Does using Vault Key or Vault Key with HSM need a dedicated configuration I missed?
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
An Azure service that is used to provision Windows and Linux virtual machines.
An Azure service that provides hardware security module management.
Answer accepted by question author
Hi Joey,
You need Key Vault Crypto Officer role on the key vault to create keys. Please have owner assign that role to your user.
Please click Accept Answer and upvote if the above was helpful.
Thanks.
-TP
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(137.6, 94%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Hi~
Thank you for the assistance. I will try it.
As I posted above, it seems that our account owner also cannot create keys in Key Vault directly. Is it normal?
As I posted above, it seems that our account owner also cannot create keys in Key Vault directly. Is it normal?
Yes, that is normal. The account owner would need to assign themself a role with permission to create keys as well.
Yes, I made it.
Thank you for your assistance!