[APIM] KV access updates

Author: gitName

articles/api-management/api-management-howto-properties.md

@@ -61,6 +61,7 @@ Using key vault secrets is recommended because it helps improve API Management s
 
 [!INCLUDE [api-management-key-vault-access](../../includes/api-management-key-vault-access.md)]
 
+[!INCLUDE [api-management-key-vault-secret-access](../../includes/api-management-key-vault-secret-access.md)]
 
 [!INCLUDE [api-management-key-vault-network](../../includes/api-management-key-vault-network.md)]
 

articles/api-management/api-management-howto-use-managed-service-identity.md

@@ -123,10 +123,12 @@ The `tenantId` property identifies which Microsoft Entra tenant the identity bel
 
 ## Configure Key Vault access using a managed identity
 
-The following configurations are needed for API Management to access secrets and certificates from an Azure key vault.
+The following configurations are needed for API Management to access certificates from an Azure key vault.
 
 [!INCLUDE [api-management-key-vault-access](../../includes/api-management-key-vault-access.md)]
 
+[!INCLUDE [api-management-key-vault-certificate-access](../../includes/api-management-key-vault-certificate-access.md)]
+
 [!INCLUDE [api-management-key-vault-network](../../includes/api-management-key-vault-network.md)]
 
 ## Supported scenarios using system-assigned identity

articles/api-management/configure-custom-domain.md

@@ -91,6 +91,7 @@ To fetch a TLS/SSL certificate, API Management must have the list and get secret
 
     [!INCLUDE [api-management-key-vault-access](../../includes/api-management-key-vault-access.md)]
 
+    [!INCLUDE [api-management-key-vault-certificate-access](../../includes/api-management-key-vault-certificate-access.md)]
 
 If the certificate is set to `autorenew` and your API Management tier has an SLA (that is, in all tiers except the Developer tier), API Management will pick up the latest version automatically, without downtime to the service.
 

includes/api-management-key-vault-access.md

@@ -19,12 +19,3 @@ ms.author: danlep
     1. On the **Principal** tab,  **Select principal**, search for  the resource name of your managed identity, and then select **Next**.
          If you're using a system-assigned identity, the principal is the name of your API Management instance.
     1. Select **Next** again. On the **Review + create** tab, select **Create**.
-    
-    **To configure Azure RBAC access:<br/>**
-
-    1. In the left menu, select **Access control (IAM)**.
-    1. On the **Access control (IAM)** page, select **Add role assignment**.
-    1. On the **Role** tab, select **Key Vault Secrets User**.
-    1. On the **Members** tab, select **Managed identity** > **+ Select members**.
-    1. On the **Select managed identity** page, select the system-assigned managed identity or a user-assigned managed identity associated with your API Management instance, and then select **Select**.
-    1. Select **Review + assign**.

includes/api-management-key-vault-certificate-access.md

@@ -0,0 +1,15 @@
+---
+author: dlepow
+ms.service: azure-api-management
+ms.topic: include
+ms.date: 02/21/2025
+ms.author: danlep
+---   
+**To configure Azure RBAC access:<br/>**
+
+1. In the left menu, select **Access control (IAM)**.
+1. On the **Access control (IAM)** page, select **Add role assignment**.
+1. On the **Role** tab, select **Key Vault Certificate User**.
+1. On the **Members** tab, select **Managed identity** > **+ Select members**.
+1. On the **Select managed identity** page, select the system-assigned managed identity or a user-assigned managed identity associated with your API Management instance, and then select **Select**.
+1. Select **Review + assign**.

includes/api-management-key-vault-secret-access.md

@@ -0,0 +1,15 @@
+---
+author: dlepow
+ms.service: azure-api-management
+ms.topic: include
+ms.date: 02/21/2025
+ms.author: danlep
+---   
+**To configure Azure RBAC access:<br/>**
+
+1. In the left menu, select **Access control (IAM)**.
+1. On the **Access control (IAM)** page, select **Add role assignment**.
+1. On the **Role** tab, select **Key Vault Secrets User**.
+1. On the **Members** tab, select **Managed identity** > **+ Select members**.
+1. On the **Select managed identity** page, select the system-assigned managed identity or a user-assigned managed identity associated with your API Management instance, and then select **Select**.
+1. Select **Review + assign**.