Share via

Cannot access vault with private link with 3.225.0 hosted agent

Gabor2, Victor-Vasile2 0 Reputation points
2024-06-19T09:31:02.54+00:00

Hi,

we are using Azure DevOps with hosted agent to deploy one app. In the deployment process we are using some vault secrets. Vault is with private endpoint.

When we run the pipeline from the hosted agent with version 3.240.1 we cannot access the vault. We get:

ClientID: "Public network access is disabled and request is not from a trusted service nor via an approved private link.\r\nCaller: appid=***;oid=5a3a.....908f73;iss=https://sts.windows.net/36da4.....99921/\r\nVault: kv-qrm-02;location=westeurope. The specified Azure service connection needs to have Get, List secret management permissions on the selected key vault. To set these permissions, download the ProvisionKeyVaultPermissions.ps1 script from build/release logs and execute it, or set them from the Azure portal."

Authority: "Public network access is disabled and request is not from a trusted service nor via an approved private link.\r\nCaller: appid=***;oid=5a3a.....908f73;iss=https://sts.windows.net/36da4.....99921/\r\nVault: kv-qrm-02;location=westeurope. The specified Azure service connection needs to have Get, List secret management permissions on the selected key vault. To set these permissions, download the ProvisionKeyVaultPermissions.ps1 script from build/release logs and execute it, or set them from the Azure portal."

Scope: "Public network access is disabled and request is not from a trusted service nor via an approved private link.\r\nCaller: appid=***;oid=5a3a.....908f73;iss=https://sts.windows.net/36da4.....99921/\r\nVault: kv-qrm-02;location=westeurope. The specified Azure service connection needs to have Get, List secret management permissions on the selected key vault. To set these permissions, download the ProvisionKeyVaultPermissions.ps1 script from build/release logs and execute it, or set them from the Azure portal."

ApiEndPoint: "Public network access is disabled and request is not from a trusted service nor via an approved private link.\r\nCaller: appid=***;oid=5a3a.....908f73;iss=https://sts.windows.net/36da4.....99921/\r\nVault: kv-qrm-02;location=westeurope. The specified Azure service connection needs to have Get, List secret management permissions on the selected key vault. To set these permissions, download the ProvisionKeyVaultPermissions.ps1 script from build/release logs and execute it, or set them from the Azure portal."

Uploading D:\myagent_225\_work\1\ProvisionKeyVaultPermissions.ps1 as attachment

however, on the 3.225.0 agent it works without any pipeline change.

We are using the same azure devops agent all the time, agents are installed on the same partition. What can cause this issue?

Thanks,

Victor

Not Monitored
Not Monitored
Tag not monitored by Microsoft.
37,103 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ManoharLakkoju 615 Reputation points Microsoft Vendor
    2024-06-19T10:02:34.5966667+00:00

    @Gabor2, Victor-Vasile2

    Welcome to Microsoft Q&A Platform, thanks for posting your query here. Azure DevOps related queries/issues are currently not supported on this Microsoft Q&A platform.

    I would request you to please post your queries in dedicated forums as in below links:

    https://developercommunity.visualstudio.com/spaces/21/index.html

    https://developercommunity.visualstudio.com/t/get-unique-id-from-devops-organization/756710

    https://stackoverflow.com/questions/tagged/azure-devops

    0 comments