App Setting KV references | Azure Function App

Abhay Chandramouli 966

Hi,
I was running diagnostics on my azure function app, when I am getting
[ResolveWorkitem] AccessToKeyVaultDenied error while retrieving Key Vault Secret Reference @Microsoft.KeyVault
Exception: KeyVaultResolver.Common.ReferenceResolverException: Exception of ...

Can you help fix this ?

SnehaAgrawal-MSFT 18,366 Reputation points

2024-04-24T08:10:31.4433333+00:00
@Abhay Chandramouli Thanks for reaching here! If a reference isn't resolved properly, the reference string is used instead (for example, @Microsoft.KeyVault(...)). It may cause the application to throw errors, because it's expecting a secret of a different value.

Failure to resolve is commonly due to a misconfiguration of the Key Vault access policy. However, it could also be due to a secret no longer existing or a syntax error in the reference itself.

If the syntax is correct, you can view other causes for error by checking the current resolution status in the portal. Navigate to Application Settings and select "Edit" for the reference in question. The edit dialog shows status information, including any errors. If you don't see the status message, it means that the syntax is invalid and not recognized as a key vault reference.

You can also use one of the built-in detectors to get additional information.

In the portal, navigate to your app.

Navigate to Platform features.

Select Diagnose and solve problems.

Choose Availability and Performance and select Function app down or reporting errors.

Select Key Vault Application Settings Diagnostics.

If everything else, e.g., access policies and syntax, appears to be in order and yet your references don't resolve, try checking if your Key Vault has any network restriction.

Check if you see the warning related to the 'network access control' on your Vault's Access policies settings page, you need to allow your app's IP through the Key Vault firewall.

Add your app’s IP (available under Custom domains) to your Key Vault’s firewall (under Networking).

You may refer to detailed blog on Troubleshooting Azure Key Vault References in Azure Function Apps credit-Dhyanendra

Please let us know if further query or issue remains.