Unable to access secrets in key vault - "The connection to data plane failed"

Question

Hello,

I created a new key vault and when trying to view/manage secrets I get the error across the top of the page saying:

"The connection to data plane failed. Please refresh and try again. If Private Links are enabled on the vault and the issue persists please follow the steps in the following link https://go.microsoft.com/fwlink/?linkid=2156688"

I have 'Key Vault Administrator' access over the vault

Answer 1

Hi Kav,

From one of your comments above it appears you are getting 5xx error from Key Vault, which would need to be fixed by support (by creating new support request in portal), or perhaps if you didn't need the contents of the vault you could create a new one.

Please open Cloud Shell, run command similar to below, and post output in a comment. Output will hopefully give us better idea of the error you are getting as well as a potential clue of cause, etc.

Get-AzKeyVaultSecret -VaultName yourKeyVaultName -Debug

Do you remember last change that was made before it started returning an error? For example, a new secret was created, and then after that it was broken? Are there any characters in any of the secret names besides a-z 0-9?

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Answer 2

Hi @Kav
Thank you for posting your query on Q&A I apologize for the delayed response!

I Understand that when you trying to view/manage secrets you are getting the following error message.

The connection to data plane failed. Please refresh and try again. If Private Links are enabled on the vault and the issue persists please follow the steps in the following link https://go.microsoft.com/fwlink/?linkid=2156688"

The error message states that there is a problem with network connection between Azure key vault and client it could be following reasons.

• A Firewall rule is blocking traffic to the Azure Key Vault. Check your firewall rules to make sure that traffic to the Azure Key Vault is not being blocked.
• A connectivity issue between your client and the Azure Key Vault. Check the connectivity between your client and the Azure Key Vault.
• Ensure that you are using the correct subscription and resource group for the Azure Key Vault and Azure Key Vault is not in a deleted state.
• Make sure that your Private Link is correct configured. More details please go through the below documents. Diagnose private links configuration issues on Azure Key Vault
  Azure Private Link Troubleshooting Guide

If your Private Link is correctly configured or if you aren't using a Private Link or If you aren't experiencing any connectivity issues the error message might also be cause by a Tenant Mismatch if you recently deployed your Key Vault to a subscription that contains a different Tenant ID, or the subscription that owned the KV was moved to a different Tenant.

For More Info - The connection to Data Plane Failed
To resolve a potential Tenant Mismatch issue, you can update your Key Vault's Tenant ID. For more info - Moving an Azure Key Vault to another subscription.
I hope this Answer helps!

Thanks,
Akhilesh.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 3

Please make sure that the key vault data plane is in the same tenant(directory) as the tenant(directory) you are in.

In the key vault overview pane, you will see the "Directory ID" of the key vault data plane.

When you click on your name at the top right corner, you will see a link to "change directory". Make sure that the directory you see in the key vault overview pane is selected.

If you don't see the directory, then you do not have access to the data plane of the key vault.

Note that you can manage the key vault if you have RBAC permissions and you are in a different directory, but you cannot access the data (keys, secrets, certificates) if you are not in the same directory as the key vault.

Hope this helps...

Answer 4

I had this issue and had forgotten to remove an entry in my hosts file that pointed the keyvault URL to 127.0.0.1 that I had added to simulate client failures the week before. Hope this saves someone a minute in the future.