Explanation:
Box 1: An advanced access policy for the key vaults
Enable template deployment
* In the portal, select your Key Vault.
* Select Access policies.
* Select access policies
* Select Click to show advanced access policies.
* Show advanced access policies
* Select Enable access to Azure Resource Manager for template deployment. Then, select Save.
Box 2: Role-based access control (RBAC)
In large teams you may have multiple people deploying resources but don't want to give them access to the actual secrets inside the vault. You can achieve this by creating a custom role that only gives access to the KeyVault for deployment purposes. The deployment user cannot read the secrets within.
Reference:
https://docs.microsoft.com/bs-latn-ba/azure/managed-applications/key-vault-access
https://azurecto.com/azure-key-vault-custom-role-for-deployment/