Managing access to Key Vault
Once we have created a Key Vault resource, we can add our application secrets, keys, and certificates to it. When an application needs to access information stored in the vault, it can access it over a REST API (Figure 12.2). This access always requires authentication and authorization (there is no option to grant anonymous access). Azure Key Vault's REST API uses Azure AD to authenticate requesting applications or clients.
Figure 12.2 – Azure Key Vault REST API
After a requesting client is authenticated using Azure AD and an OAuth token has been granted, the Key Vault API will then verify whether the requesting identity has the required permission to perform the operation that is being requested (authorization). This permission can be granted to Azure AD security principals such as users, service principals, and managed identities. To understand how permission is granted in Key Vault, let's review the two...
