Update Function Key Vault Role Assignment

The Key vault must be updated to allow the Function App to decrypt the policy files. The Forwarder is using policy to confirm the authenticity of audit logs it receives from Event Hub and to digitally sign the aggregated logs that it sends to ESA. Assign the appropriate Key Vault roles to the function identity:

1. From Azure console navigate to Key Vaults, select the Key Vault created in Key Vault.
2. Select Access control (IAM).
3. Click Add > Add role assignment.
4. Under Role, search for and select Key Vault Crypto User.
5. Under Members, select Managed identity and choose the function identity: a. For functions with user-assigned identity, select the identity recorded in step Function User-Assigned Managed Identity. b. For functions with system-assigned identity, select the function name recorded in step Install Log Forwarder via ARM template.
6. Click Review + assign.
7. Repeat steps 3-6 to assign the Key Vault Secrets User role to the same identity.