I want to lock down my Key Vault as securely as possible. I believe access control is who can access and modify the Key Vault as a whole. Access policies are who or what can access secrets.
Our admin group should be in the access control group. Our App Service (which has a managed identity) should be in access policies. I don't think there is any need for anymore than this?
Yes, you are right.
The Access control (IAM) is in management plane, the Access policies is in data plane.
In your case, you should note if your admin group is just in the Access control (IAM), even if it is Owner/Contributor, the user in the group will not be able to access the secrets directly, unless the user adds himself to the Access policies.
Similarly, if you don't want the user/service principal/group to access the secrets, never add them to the Access control (IAM) as roles like e.g Owner/Contributor, because they will be able to add themselves to the Access policies.
