I'm in the process of exploring whether Azure Access Control (IAM) can be used for authenticating DevOps to read Key Vault secrets. I've successfully managed this previously using the "older" Access Policies - granting 'Get, List' permissions, but I'm looking to transition to a modern role based Access Control if possible. Has anyone managed to successfully implement Access Control (IAM) for this purpose? The Azure Subscription is set up with the following roles: - Key Vault Secrets Officer - Key Vault Secrets User However, I'm encountering an issue when attempting access, receiving the error message: "The specified Azure service connection requires 'Get, List' secret management permissions for the target key vault." For context, the initial Access Policy configuration was based on the guidelines from this blog: https://azuredevopslabs.com/labs/vstsextend/azurekeyvault/

I'll double check my configuration. One word of warning certificates are not supported for app services using RBAC

Thank you! I've found this Stack Overflow on the Firewall connection settings which could be useful: https://stackoverflow.com/questions/50968613/cannot-acces-keyvault-secrets-through-service-endpoint-in-a-vsts-release