title: Deploy Web App certificate from Azure Keyvault and create SSL binding
body: <p>I have been trying to figure out to fix the below problem while deploying Azure RM template.</p>
  
  <pre><code>New-AzureRmResourceGroupDeployment : 9:54:31 PM - Resource Microsoft.Web/certificates 'redacted' failed with message '{   "Code": "BadRequest",   "Message": "The service does not have access to '/subscriptions/redacted/resourcegroups/redacted/providers/microsoft.keyvault/vaults/redacted' Key Vault. Please make sure that you have  granted necessary permissions to the service to perform the request operation.",   "Target": null,   "Details": [
      {
        "Message": "The service does not have access to  '/subscriptions/redacted/resourcegroups/redacted/providers/microsoft.keyvault/vaults/redacted' Key Vault. Please make sure that you have  granted necessary permissions to the service to perform the request operation."
      },
      {
        "Code": "BadRequest"
      },
      {
        "ErrorEntity": {
          "ExtendedCode": "59716",
          "MessageTemplate": "The service does not have access to '{0}' Key Vault. Please make sure that you have granted necessary permissions to the service to perform  the request operation.",
          "Parameters": [          "/subscriptions/redacted/resourcegroups/redacted/providers/microsoft.keyvault/vaults/redacted"
          ],
          "Code": "BadRequest",
          "Message": "The service does not have access to  '/subscriptions/redacted/resourcegroups/redacted/providers/microsoft.keyvault/vaults/redacted' Key Vault. Please make sure that you have  granted necessary permissions to the service to perform the request operation."
        }
      }   ],   "Innererror": null }' At line:1 char:1
  + New-AzureRmResourceGroupDeployment -Name redacted -ResourceGroupName  ...
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : NotSpecified: (:) [New-AzureRmResourceGroupDeployment], Exception
      + FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet New-AzureRmResourceGroupDeployment : 9:54:31 PM - Template output evaluation skipped: at least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details. At line:1 char:1
  + New-AzureRmResourceGroupDeployment -Name redacted -ResourceGroupName  ...
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : NotSpecified: (:) [New-AzureRmResourceGroupDeployment], Exception
      + FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet New-AzureRmResourceGroupDeployment : 9:54:31 PM - Template output evaluation skipped: at least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-debug for usage details. At line:1 char:1
  + New-AzureRmResourceGroupDeployment -Name redacted -ResourceGroupName  ...
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  + CategoryInfo          : NotSpecified: (:) [New-AzureRmResourceGroupDeployment], Exception
      + FullyQualifiedErrorId : Microsoft.Azure.Commands.ResourceManager.Cmdlets.Implementation.NewAzureResourceGroupDeploymentCmdlet
  </code></pre>
  
  <p>I have created a web app and want to bind an SSL certificate stored as a secret from Azure Keyvault. At first, I have created a self-signed certificate and uploaded it to keyvault as a 'secret'. From the Azure Active Directory, I have created a web app and used the application ID to grant access to key vault.</p>
  
  <p>Following deployment template was used:</p>
  
  <p><a href="https://github.com/Azure/azure-quickstart-templates/tree/master/201-web-app-certificate-from-key-vault" rel="nofollow noreferrer">Azure RM template for deploying web app certificate from keyvault</a></p>