diff --git a/src/azure-cli/azure/cli/command_modules/keyvault/_client_factory.py b/src/azure-cli/azure/cli/command_modules/keyvault/_client_factory.py
index b4575771af5..0d122b77a3f 100644
--- a/src/azure-cli/azure/cli/command_modules/keyvault/_client_factory.py
+++ b/src/azure-cli/azure/cli/command_modules/keyvault/_client_factory.py
@@ -6,6 +6,7 @@
 from enum import Enum
 from knack.util import CLIError
 
+from azure.cli.core.azclierror import RequiredArgumentMissingError
 from azure.cli.core.commands import CliCommandType
 from azure.cli.core.profiles import get_api_version, ResourceType
 from azure.cli.core._profile import Profile
@@ -200,9 +201,12 @@ def data_plane_azure_keyvault_administration_backup_client(cli_ctx, command_args
     version = str(get_api_version(cli_ctx, ResourceType.DATA_KEYVAULT_ADMINISTRATION_BACKUP))
     profile = Profile(cli_ctx=cli_ctx)
     credential, _, _ = profile.get_login_credentials(resource='https://managedhsm.azure.net')
-    vault_url = command_args['hsm_name']
+    vault_url = \
+        command_args.get('hsm_name', None) or \
+        command_args.get('vault_base_url', None) or \
+        command_args.get('identifier', None)
     if not vault_url:
-        vault_url = command_args['vault_base_url']
+        raise RequiredArgumentMissingError('Please specify --hsm-name or --id')
     return KeyVaultBackupClient(
         vault_url=vault_url, credential=credential, api_version=version)
 
@@ -213,8 +217,11 @@ def data_plane_azure_keyvault_administration_access_control_client(cli_ctx, comm
     version = str(get_api_version(cli_ctx, ResourceType.DATA_KEYVAULT_ADMINISTRATION_ACCESS_CONTROL))
     profile = Profile(cli_ctx=cli_ctx)
     credential, _, _ = profile.get_login_credentials(resource='https://managedhsm.azure.net')
-    vault_url = command_args['hsm_name']
+    vault_url = \
+        command_args.get('hsm_name', None) or \
+        command_args.get('vault_base_url', None) or \
+        command_args.get('identifier', None)
     if not vault_url:
-        vault_url = command_args['vault_base_url']
+        raise RequiredArgumentMissingError('Please specify --hsm-name or --id')
     return KeyVaultAccessControlClient(
         vault_url=vault_url, credential=credential, api_version=version)
diff --git a/src/azure-cli/azure/cli/command_modules/keyvault/_validators.py b/src/azure-cli/azure/cli/command_modules/keyvault/_validators.py
index a1dd274c6c1..c85f812231d 100644
--- a/src/azure-cli/azure/cli/command_modules/keyvault/_validators.py
+++ b/src/azure-cli/azure/cli/command_modules/keyvault/_validators.py
@@ -16,6 +16,7 @@
 
 from azure.cli.core.commands.client_factory import get_mgmt_service_client
 from azure.cli.core.commands.validators import validate_tags
+from azure.cli.core.azclierror import RequiredArgumentMissingError
 
 
 secret_text_encoding_values = ['utf-8', 'utf-16le', 'utf-16be', 'ascii']
@@ -437,6 +438,13 @@ def validate_subnet(cmd, namespace):
         raise CLIError('incorrect usage: [--subnet ID | --subnet NAME --vnet-name NAME]')
 
 
+def validate_role_assignment_args(ns):
+    if not any([ns.role_assignment_name, ns.scope, ns.assignee, ns.assignee_object_id, ns.role, ns.ids]):
+        raise RequiredArgumentMissingError(
+            'Please specify at least one of these parameters: '
+            '--name, --scope, --assignee, --assignee-object-id, --role, --ids')
+
+
 def validate_vault_or_hsm(ns):
     identifier = getattr(ns, 'identifier', None)
     vault_base_url = getattr(ns, 'vault_base_url', None)
diff --git a/src/azure-cli/azure/cli/command_modules/keyvault/commands.py b/src/azure-cli/azure/cli/command_modules/keyvault/commands.py
index 61dfefe83bd..06df365c536 100644
--- a/src/azure-cli/azure/cli/command_modules/keyvault/commands.py
+++ b/src/azure-cli/azure/cli/command_modules/keyvault/commands.py
@@ -17,7 +17,7 @@
 
 from azure.cli.command_modules.keyvault._validators import (
     process_secret_set_namespace, process_certificate_cancel_namespace,
-    validate_private_endpoint_connection_id)
+    validate_private_endpoint_connection_id, validate_role_assignment_args)
 
 
 def transform_assignment_list(result):
@@ -273,7 +273,7 @@ def load_command_table(self, _):
             pass
 
         with self.command_group('keyvault role assignment', data_access_control_entity.command_type) as g:
-            g.keyvault_custom('delete', 'delete_role_assignment')
+            g.keyvault_custom('delete', 'delete_role_assignment', validator=validate_role_assignment_args)
             g.keyvault_custom('list', 'list_role_assignments', table_transformer=transform_assignment_list)
             g.keyvault_custom('create', 'create_role_assignment')