The Key Vault Reader role is the minimum user role required to read the metadata of certificates, keys, and secrets stored in an Azure Key Vault. This role allows users to view the properties and attributes of these objects, but not to access their actual contents. Reference: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide