diff --git a/internal/services/media/media_services_account_resource.go b/internal/services/media/media_services_account_resource.go
index 00ebeee11179..5a9e22f85057 100644
--- a/internal/services/media/media_services_account_resource.go
+++ b/internal/services/media/media_services_account_resource.go
@@ -523,7 +523,7 @@ func flattenMediaServicesAccountIdentity(input *accounts.MediaServiceIdentity) (
 }
 
 func expandMediaServicesAccountKeyDelivery(input []interface{}) *accounts.KeyDelivery {
-	if len(input) == 0 {
+	if len(input) == 0 || input[0] == nil {
 		return nil
 	}
 
diff --git a/internal/services/media/media_services_account_resource_test.go b/internal/services/media/media_services_account_resource_test.go
index a7663acc05c4..8460fe141abb 100644
--- a/internal/services/media/media_services_account_resource_test.go
+++ b/internal/services/media/media_services_account_resource_test.go
@@ -340,7 +340,7 @@ resource "azurerm_key_vault_access_policy" "client" {
   key_vault_id       = azurerm_key_vault.test.id
   tenant_id          = data.azurerm_client_config.current.tenant_id
   object_id          = data.azurerm_client_config.current.object_id
-  key_permissions    = ["Get", "Create", "Delete", "List", "Restore", "Recover", "UnwrapKey", "WrapKey", "Purge", "Encrypt", "Decrypt", "Sign", "Verify"]
+  key_permissions    = ["Get", "Create", "Delete", "List", "Restore", "Recover", "UnwrapKey", "WrapKey", "Purge", "Encrypt", "Decrypt", "Sign", "Verify", "GetRotationPolicy"]
   secret_permissions = ["Get"]
 }