Same role can be assigned to shared key vault using bicep script for multiple environment. We have two resource group in our azure subscription one for stage and another for production environment and we have only one shared resource group containing one shared key vault that is used by both environment. During the production deployment role is getting assigned to shared key vault but when we are doing the deployment to stage it is failed with error "RoleAssignmentUpdateNotPermitted\"."

### Resource Type

key vault

### Api Version

2022-01-01

### Issue Type

Resource fails to deploy

### Other Notes

We are using bicep scripts to deploy SonarQube application in azure resources. We have two environments i.e., stage and production.

We have two resource group in our azure subscription one for stage and- another for production environment and we have only one shared resource group containing one shared key vault that is used by both stage and production environment.

First, we did the PROD Deployment, and the deployment gets successful, after this we started the STAGE deployment, and the deployment gets failed, and we are getting the below error:
------------------------------
**ERROR: {"status":"Failed","error":{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"Conflict","message":"{\r\n \"status\": \"Failed\",\r\n \"error\": {\r\n \"code\": \"ResourceDeploymentFailure\",\r\n \"message\": \"The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.\",\r\n \"details\": [\r\n {\r\n \"code\": \"DeploymentFailed\",\r\n \"target\": \"/subscriptions/xxxxxxxxxxxxxxxx/resourceGroups/xxxxxxxxxxxx/providers/Microsoft.Resources/deployments/modulekvidentityroleassignmentonvault\",\r\n \"message\": \"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.\",\r\n \"details\": [\r\n {\r\n \"code\": \"RoleAssignmentUpdateNotPermitted\",\r\n \"message\": \"Tenant ID, application ID, principal ID, and scope are not allowed to be updated.\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n}"}]}}**
---------------------------------

We are running up in a situation where role assignment is already done once at the time of PROD deployment and we are not able to do once again during the STAGE deployment, since we need this role to fetch the secrets and certificates from the key vault.

We have a module where it assigns certain roles to the key vault that is getting successful during the production deployment but next time when we try to deploy the same for stage it is throwing an error.

Could anyone of you please let us know the same role can be assigned to the key vault when we will be performing the multiple environment deployment and if this is possible let us know the approach.

### Bicep Repro

_No response_

### Confirm

- [X] I have read the troubleshooting guide and looked for duplicates.

Start by reviewing the role-assignment module described in the issue and reproduce the deployment in the stated production-then-stage order. Use the reported RoleAssignmentUpdateNotPermitted error to determine the supported multi-environment configuration; done means documenting or validating an approach that lets both environments use the shared key vault.

Written by the indexing model from the issue text.