We are unable to import the SSL certificate from Key Vault into App Service for custom domain binding.

Assign Key Vault Certificate User on the vault to the Microsoft Azure App Service platform service principal—not to the web app’s managed identity—because Key Vault certificate import is performed by the App Service resource provider.^1^

Grant the required RBAC role

In the Azure portal:

1. Open the Key Vault containing the certificate.
2. Select Access control (IAM) → Add → Add role assignment.
3. Select Key Vault Certificate User.
4. For the member, select the enterprise application/service principal named:
   • Microsoft Azure App Service
   • It may also appear as Azure App Service or Microsoft.Azure.WebSites.
5. Assign the role at the Key Vault scope.
6. Allow several minutes for RBAC propagation.

For standard Azure public cloud, the equivalent Azure CLI command is:

vaultId=$(az keyvault show \
  --resource-group <vault-resource-group> \
  --name <key-vault-name> \
  --query id --output tsv)

az role assignment create \
  --role "Key Vault Certificate User" \
  --assignee "abfa0a7c-a6b6-4736-8310-5855508787cd" \
  --scope "$vaultId"

The assignee above is the App Service resource-provider application ID for Azure public cloud. Azure Government uses a different documented application ID. For ARM or Bicep role assignments, resolve and use the corresponding enterprise application’s object ID, rather than its application ID.^1^

Giving the web app’s system-assigned or user-assigned managed identity access does not authorize this platform import operation. That managed identity is relevant when application code accesses Key Vault directly, not when App Service imports a certificate.^2^

Retry the import

After the assignment has propagated:

1. Open App Service → Settings → Certificates.
2. Select Bring your own certificates (.pfx) → Add certificate.
3. Set Source to Import from Key Vault.
4. Select the vault and certificate.
5. Select Validate, then Add.
6. Confirm that the certificate appears under Bring your own certificates (.pfx).
7. Create the custom-domain binding under Custom domains → Add binding.

App Service automatically synchronizes later Key Vault certificate versions, typically within 24 hours, so retain the role assignment after the initial import.^1^

If access still fails

• Vault firewall: If Key Vault public access is restricted by its firewall, open Key Vault → Networking and enable Allow trusted Microsoft services to bypass this firewall.^1^
• Access-policy vault: If Key Vault → Access configuration uses Vault access policy rather than Azure RBAC, grant the Microsoft Azure App Service service principal Get permission for both Secrets and Certificates.^1^
• Certificate format: The certificate must be PKCS#12/PFX with an exportable private key. For custom-domain TLS, it must include the complete chain, support server authentication, and be signed by a trusted certificate authority.^1^
• App Service plan: Private-certificate import requires the app to run on a Basic, Standard, Premium, or Isolated App Service plan.^1^

References

1. Add and manage TLS/SSL certificates in Azure App Service
2. Transition Azure Key Vaults to Azure RBAC - Microsoft Q&A