# Azure Key Vault RBAC Atlas > Source-anchored research for Azure Key Vault RBAC Atlas. Run status: COMPLETED. Parent: [MongoDB Atlas on Azure](https://llms-explorer.com/tree/mongodb-atlas-on-azure/) · 3 facets · 13 facts · page: https://llms-explorer.com/tree/azure-key-vault-rbac-atlas/ ## How it works - Atlas documents M10 or larger as the prerequisite for its Azure Key Vault secretless integration and excludes Free and Flex deployments. Inference for cost planning: an Azure key-access requirement can establish a paid cluster floor even when workload capacity would fit below it. (medium confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - When migrating an Atlas project to secretless authentication over private networking, acceptance of the configuration PATCH does not complete validation: data nodes validate access asynchronously. MongoDB warns that incorrect permissions can eventually disrupt operations and shut down the cluster. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - HashiCorp warns that managing the same Key Vault access policies both inline in azurerm_key_vault and through separate azurerm_key_vault_access_policy resources causes conflicts. Atlas infrastructure code using access policies should choose one ownership mechanism. (low confidence) — [source](https://github.com/hashicorp/terraform-provider-azurerm/blob/main/website/docs/r/key_vault.html.markdown) ## Comparisons and alternatives - Atlas secretless authentication authorizes an Atlas-managed Azure service principal and uses short-lived OAuth tokens instead of stored customer client secrets. Atlas continues to support a static-credential method alongside this option. (medium confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) ## Facts and statements - For Atlas secretless RBAC setup, MongoDB specifies Reader for vault metadata plus Key Vault Crypto User or an equivalent custom role. Microsoft distinguishes management-plane access from key operations; Key Vault Reader alone provides metadata access. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Atlas secretless authentication uses an Atlas-managed Azure service principal and short-lived OAuth tokens. Registration through Cloud Provider Access returns a roleId used in the project encryption configuration, replacing stored static credentials. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Azure RBAC and Key Vault access policies are alternative data-plane permission models for Atlas. Enabling RBAC invalidates existing access-policy permissions, so equivalent RBAC assignments must exist before a migration to avoid outages. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security-azure-kms.md) - Key Vault Contributor does not itself grant data-plane key access. Atlas instead documents cryptographic permissions including get, encrypt and decrypt; adding only a management role is insufficient. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Historical Atlas users reported generic Azure credential or connection errors despite apparently correct credentials. A 2022 Stack Overflow answerer reports that assigning Key Vault Reader at the vault let their Atlas settings save; a separate November 10, 2021 comment on the thread says Reader was insufficient for that setup and a higher vault role at subscription scope worked. These anecdotes justify checking role assignment scope, but do not prove a universal fix or a current defect. (medium confidence) — [source](https://stackoverflow.com/questions/69898618/encryption-at-rest-mongodb-azure-key-vault-unable-to-connect-to-your-azure-v) - Atlas states that revoking its customer-key access shuts down cluster nodes until access is restored. Its secretless migration guide also warns that private-network validation is asynchronous and a successful PATCH acceptance does not establish successful data-node validation. (high confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/security-azure-kms.md) - Atlas requires get, encrypt, and decrypt permissions on its Key Vault key. Key Vault Reader alone provides metadata access, while Key Vault Crypto User permits cryptographic operations; a custom role can provide equivalent required permissions. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Key Vault Contributor does not itself grant key, secret, or certificate data-plane access. It is therefore insufficient by itself for the key operations Atlas requires. (high confidence) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md) - Role changes need propagation time: Microsoft advises allowing several minutes for assignments to refresh. Validate the effective identity, permission model, scope, and required key operations before concluding that a newly assigned role has failed. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/security/azure-kms-secretless.md)