title: Azure Key Vault - Access denied
body: <p>I am creating an Azure Key Vault. I am using the below ARM JSON template. I have an App created in Azure AD and I am trying to give that app all permissions so that I can use this Apps credentials to connect to the Key Vault from a Key Vault client.</p>
  
  <p>I am using TFS, and have created a "Azure Deployment:Create Or Update Resource Group" Release definition task to automate this.</p>
  
  <pre><code>{
      "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
      "contentVersion": "1.0.0.0",
    "parameters": {
      "vaults_qnvaultdev_name": {      
        "type": "string"
      },
      "vaults_location": {     
        "type": "string"
      },
      "vaults_skufamily": {      
        "type": "string"
      },
      "vaults_skuname": {
        "type": "string"
      },
      "vaults_tenantid": {
        "type": "string"
      },
      "vaults_objectid": {
        "type": "string"
      }
    },
      "variables": {},
      "resources": [
        {
          "comments": "Generalized from resource: '/subscriptions/subscription().subscriptionId/resourceGroups/resourceGroup().name/providers/Microsoft.KeyVault/vaults/[parameters('vaults_qnvaultdev_name')]'.",
          "type": "Microsoft.KeyVault/vaults",
          "name": "[parameters('vaults_qnvaultdev_name')]",
          "apiVersion": "2015-06-01",
          "location": "[parameters('vaults_location')]",
          "tags": {},
          "scale": null,
          "properties": {
            "sku": {
              "family": "[parameters('vaults_skufamily')]",
              "name": "[parameters('vaults_skuname')]"
            },
            "tenantId": "[parameters('vaults_tenantid')]",
            "accessPolicies": [
              {
                "tenantId": "[parameters('vaults_tenantid')]",
                "objectId": "[parameters('vaults_objectid')]",
                "permissions": {
                  "keys": [
                    "All",
                    "Get",
                    "List",
                    "Update",
                    "Create",
                    "Import",
                    "Delete",
                    "Recover",
                    "Backup",
                    "Restore"
                  ],
                  "secrets": [
                    "All",
                    "Get",
                    "List",
                    "Set",
                    "Delete",
                    "Recover",
                    "Backup",
                    "Restore"
                  ]
                }
              }
            ],
            "enabledForDeployment": true
          },
          "dependsOn": []
        }
      ]
  }
  </code></pre>
  
  <p>The template executes fine, and the Key Vault is getting created. I also can see in the vault's Access Policies the Principal is getting added with all the permissions. However, after creating the vault, when I use the Principal's client id and secret to connect from a client application, I get an "Access Denied" error.</p>
  
  <p>I have noticed that if I go through the portal and manually add the App through the Key Vault's Access Policies, the Vault client is able to successfully authenticate. Am I missing something here?</p>
  
  <p><strong>Update: Issue fixed</strong>
  I gave the app permissions manually to the vault's Access Policy and checked the Resources Portal. Then I see that the "Object Id" for this App generated in the Resources portal is different from what I see in Azure AD - in the portal for this app. Any ideas why these are different?</p>