Why?

The access policy may need to be changed after a KeyVault has been created. This may be needed to grant the Microsoft.Compute resource provider access to the KeyVault.

What?

The access policy can be changed by using the Set-AzureRmKeyVaultAccessPolicy Powershell cmdlet.

How?

Figure 1: Set-AzureRmKeyVaultAccessPolicy cmdlet syntax.

Parameter Set: ForVault
Set-AzureRmKeyVaultAccessPolicy `
[-VaultName] <System.String> `
[[-ResourceGroupName] <System.String> ] `
[-EnabledForDeployment] `
[-EnabledForDiskEncryption] `
[-EnabledForTemplateDeployment] `
[-PassThru] `
[ <CommonParameters>]

-EnabledForDeployment and -EnabledForTemplateDeployment switches can be used to grant the Microsoft.Compute resource provider access to the KeyVault.

Further Reading

Create an Azure KeyVault to test the Set-AzureRmKeyVaultAccessPolicy cmdlet.

Setting up Azure KeyVault using Powershell

Works Cited:

1. https://msdn.microsoft.com/en-us/library/mt603625.aspx