Keyvault permission error to store Service principal secrets

Question

Error: checking for presence of existing Secret "Project-1-Client-Id" (Key Vault "https://project1-power-bi-kv1.vault.azure.net/"): keyvault.BaseClient#GetSecret: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="The user, group or application 'appid=04b07795-8ddb-461a-bbee-02f9e1bf7b46;oid=207fcdae-29b5-4f8d-b404-279649a0e012;numgroups=1;iss=https://sts.windows.net/a1eaf016-7200-4387-85cb-ecff07da7399/' does not have secrets get permission on key vault 'project1-power-bi-kv1;location=westus'. For help resolving this issue, please see https://go.microsoft.com/fwlink/?linkid=2125287" InnerError={"code":"AccessDenied"}

Giving permission to keyvault to store Service Principal secret

Answer 1

Find the SPN: 04b07795-8ddb-461a-bbee-02f9e1bf7b46 in your Entra Id, it should be a User, Group, App registration, User Managed IDentity or Managed Identity and access your Key Vault -> Access Policies -> Create and select Get Permissions:

Then search your Principal to assign permissions, also be sure it is inside IAM with the role assignement with the role "Key Vault Secrets Reader".