Do I need to add app on access policy of key vault if the app is already the owner on subscription level

Question

If I give owner access to an app on subscription level, do I still need to add the app on access policy in key vault so that the app can retrieve the secret value from azure key vault through http GET method?

Answer 1

The answer is yes, if you use the Vault access policy permission model.

However, the answer is no, if you use the Azure role-based access control permission model - but then you would have to assign an appropriate RBAC role since the Owner role would not have access.

Reference: Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control (preview)