Why is Key Vault firewall blocking App Service?

Question

In an Azure Key Vault, on the Networking tab I have "Allow public access from specific virtual networks and IP addresses" set. The option "Allow trusted Microsoft services to bypass this firewall" is enabled, however my app hosted in a container on Azure App Service is still unable to access the Key Vault. I need to manually add all the web app's outbound IP addresses, and then it works. Is this by design, or an issue with the firewall?

Answer 1

Hi James,

This is by design. App Service is trusted only for deploying certificate through Key Vault.

https://learn.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints#trusted-services

Please click Accept Answer if the above was useful.

Thanks.

-TP