title: How can I give access to key vault to a user assigned identity?
body: <p>Is it possible to give access to a key vault to a user assigned identity?</p>
  
  <p>In Managed Identities from the azure portal I created a new Identity "KeyVaultIdentity", which I assigned it to a web application (in Identity, user assigned identities tab). In access policies from key vault I added the new created "KeyVaultIdentity" identity and offered permissions to access the secrets. </p>
  
  <p>I am using the following code to access the key vault: </p>
  
  <pre><code>try
          {
              /* The below 4 lines of code shows you how to use AppAuthentication library to fetch secrets from your Key Vault*/
              AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
              KeyVaultClient keyVaultClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
              var secret = await keyVaultClient.GetSecretAsync("https://play9VaultDemo.vault.azure.net/secrets/AppSecret")
                  .ConfigureAwait(false);
              Message = secret.Value;
  
              /* The below do while logic is to handle throttling errors thrown by Azure Key Vault. It shows how to do exponential backoff which is the recommended client side throttling*/
              do
              {
                  long waitTime = Math.Min(getWaitTime(retries), 2000000);
                  secret = await keyVaultClient.GetSecretAsync("https://play9VaultDemo.vault.azure.net/secrets/AppSecret")
                      .ConfigureAwait(false);
                  retry = false;
              }
              while (retry &amp;&amp; (retries++ &lt; 10));
          }
          /// &lt;exception cref="KeyVaultErrorException"&gt;
          /// Thrown when the operation returned an invalid status code
          /// &lt;/exception&gt;
          catch (KeyVaultErrorException keyVaultException)
          {
              Message = keyVaultException.Message;
              if ((int)keyVaultException.Response.StatusCode == 429)
                  retry = true;
          }
  </code></pre>
  
  <p>But it says that access is forbidden when I try to access the secret. However if in Key Vault I give access to the System Assigned Identity of the Web application, I can access the secret,</p>
  
  <p>Do you have any idea how can I make this work with the user assigned identity?</p>