Private Link Error Creating Key Vault

Question

Private Link Error Creating Key Vault

Dave O'Donohoe 170

Hi,

I am getting the below error when trying to create a new Key Vault in Azure.

Is this a possible known bug with Microsoft?

Any steer much appreciated.

Connection is not an approved private link and caller was ignored because bypass is not set to 'AzureServices' and PublicNetworkAccess is set to 'Disabled'. Vault: MyKeyvault12354;location=centralus

Thanks.

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-07-24T20:10:32.6466667+00:00

@Dave O'Donohoe

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Dave O'Donohoe 170 Reputation points

2023-07-28T14:46:06.5+00:00

Hi guys, has anyone any comments on my most recent questions, and hopefully we can then get it marked as answered?

Accepted answer

0 additional answers

Your answer

JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-07-24T20:10:32.6466667+00:00

@Dave O'Donohoe

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Dave O'Donohoe 170 Reputation points

2023-07-28T14:46:06.5+00:00

Hi guys, has anyone any comments on my most recent questions, and hopefully we can then get it marked as answered?

Answer 1

Akshay-MSFT 17,951 Microsoft Employee Moderator

@Dave O'Donohoe

Thank you for posting your query on Microsoft Q&A.

From above description it seems like you are getting the access issue with message "Connection is not an approved private link and caller was ignored because bypass is not set to 'AzureServices' and PublicNetworkAccess is set to 'Disabled' " while trying to create a new KeyVault MyKeyvault12354.

How ever such error occurs when you try to create/add new key/secrets to the KeyVault. Assuming which I am responding below

Please do correct me if this is not the case by responding in the comments section also do share the screenshot to validate the error generating step .

This error occurs when :

You have disabled public access on KeyVault.
Allow trusted Microsoft services to bypass this firewall is not checked.

User's image

And the service or device you are accessing this KeyVault from is not using the allowed private IP.

User's image

Solution: Allow public access from specific virtual networks and IP addresses and adding your device IP address to it would fix the issue.

User's image

Also if you are trying access the vault via a Trusted Microsoft service then set Allow trusted Microsoft services to bypass this firewall.

User's image

Please do let me know if you have any queries by responding in the comments section.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Dave O'Donohoe 170 Reputation points

2023-07-21T13:57:43.33+00:00

Thank you for the detailed response.

We have Disable Public Access checked, with Allow Trusted MS Services checked also.

Does that mean any sources within Azure will be auto trusted, or do I need to check Allow specific vnets access and manually specify client source ranges within Azure?
Dave O'Donohoe 170 Reputation points

2023-07-21T13:57:59.3533333+00:00

Thank you for the detailed response.

We have Disable Public Access checked, with Allow Trusted MS Services checked also.

Does that mean any sources within Azure will be auto trusted, or do I need to check Allow specific vnets access and manually specify client source ranges within Azure?
Akshay-MSFT 17,951 Reputation points Microsoft Employee Moderator

2023-07-24T06:12:35.5866667+00:00
@Dave O'Donohoe

PFB answers in line:

Does that mean any sources within Azure will be auto trusted? No, this means only these Trusted services will be exempted.

Do I need to check Allow specific vnets access and manually specify client source ranges within Azure? Yes, you need to add the vnets manually to allow services/clients from those vnet to access the Key Vault.

Please do let me know if you have any further questions.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.
Dave O'Donohoe 170 Reputation points

2023-07-26T09:53:40.3366667+00:00

Thanks again Akshay.

My interpretation of Disable Public Access, would be to disable public or internet access only. Based on what your saying, checking this box, disables ALL access, even private networsk? Is that a fair assumption?

Im slightly perplexed as to why anyone would want to disable ALL access to KV.

Could you advise on a use case for Disabling Public Access?
Dave O'Donohoe 170 Reputation points

2023-07-26T09:58:43.6133333+00:00

Duplicate message, deleted.
Dave O'Donohoe 170 Reputation points

2023-07-31T16:08:57.68+00:00

Please can I get some feedback here :)
Akshay-MSFT 17,951 Reputation points Microsoft Employee Moderator

2023-08-02T09:18:05.57+00:00
@Dave O'Donohoe

PFB answer inline:

My interpretation of Disable Public Access, would be to disable public or internet access only. Based on what your saying, checking this box, disables ALL access, even private networks? Is that a fair assumption?

Yes Disable public access would block access of all services to the keyvault. No public traffic will be able to access this resource, Learn more, not even trusted Microsoft services until checked.

Could you advise on a use case for Disabling Public Access?

This is majorly used when admins save there trusted root certificate in the kayvault and use subordinate root certificates for trust.

Please do let me know if you have any further queries on this.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.
Dave O'Donohoe 170 Reputation points

2023-08-02T16:01:43.4+00:00

Thanks. But does checking "trusted MS sources" essentially mean anything within the Azure eco can connect successfully?
Akshay-MSFT 17,951 Reputation points Microsoft Employee Moderator

2023-08-02T16:08:14.2533333+00:00

@Dave O'Donohoe

Seems like you missed my response earlier.

No, this means only these Trusted services will be exempted.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.
Dave O'Donohoe 170 Reputation points

2023-08-03T08:01:04.74+00:00

Ok thanks. I think "Disable Public Access" is slightly misleading, and based on the comments here in this thread, probably should be "Disable ALL Access".

Share via

Private Link Error Creating Key Vault

0 additional answers

Your answer