[CLI/PS] KeyVault -Remove client-side RBAC assignment creation logic for Key Vault and rely on service API behavior

[Alex-AZPS]

Background

Currently, Azure CLI and Azure PowerShell implement custom client-side logic to handle Key Vault RBAC authorization during Key Vault creation. This logic predates the service API support and was introduced to provide a consistent RBAC experience for users.

The Key Vault service API now natively supports RBAC authorization configuration as part of the resource creation workflow. Maintaining client-side logic creates duplicate behavior, increases maintenance cost, and introduces the risk of divergence between client tools and service implementation.

Problem Statement

Azure CLI and Azure PowerShell currently override or supplement Key Vault RBAC configuration through client-side implementation.

Remove the client-side RBAC assignment/configuration logic from Azure CLI and Azure PowerShell.

Instead:

Pass user-specified parameters directly to the Key Vault service API.
Rely on the service-defined API contract and behavior for RBAC configuration.
Eliminate any client-specific RBAC handling that duplicates service functionality.
Ensure client tools remain aligned with the latest Key Vault API implementation.

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

🔔 Routing this issue to @Azure/act-identity-squad.