unable to link customer managed key within azure storage account get the error Your system-assigned identity does not have access to the key vault

Question

I am unable to link a customer managed key for a storage account, it complains with the error below.

Assuming the storage account is called storage123, I granted access to the principal called storage123, and the role granted was Key Vault Crypto Service Encryption User

Your system-assigned identity does not have access to the key vault. You can request access to the key vault by sending your admin the object ID from Identity under Security + networking when system-assigned status is enabled

Not sure what to do, I have got the key vault administrator role assigned to myself, so I dont think the issue is from my side, unsure of what else to do.

Answer 1

When you select System Managed Identity, you will no longer use a service principle that you created. It is the Object ID of your storage account that needs to have access to the key vault.

The error message clearly says that you should use the Object ID from Identity under Security + Networking when system-Assigned status is enabled.

So go to the storage account and find the object ID from Identity under Security + Networking and assign it the required permission on key vault and that should be it.