VNet integrated flex consumption app unable to connect to KeyVault via service endpoint

Question

Hi,

I have a question about vnet integrated flex function apps and accessing other resources privately using service endpoints

Situation:

I have Flex consumption app successfully deployed and vnet integrated so all outbound traffic is via the virtual network

The subnet is delegated to Microsoft.App/environments as required for Flex apps and ive also added service endpoints for Storage, KeyVault and AzureCosmosDB

I have a Key Vault that is set up to "Allow public access from specific virtual networks and IP addresses" and have added a rule to allow the virtual network and subnet used by the Flex app to access the Key Vault

Issue:

Key Vault references in app settings are not able to resolve and I get the following error:

Key Vault reference was not able to be resolved because site was denied access to Key Vault reference's vault.

Thoughts:

1. When i set the Key Vault networking configuration to "Allow public access from all networks" the references resolve and everything works - which suggests maybe my function app outbound traffic is not going via the vnet
2. Im unclear if service endpoints are allowed to use with vnet integrated flex apps.

In Microsoft's documentation it mentions:

*"The subnet you choose can't already be used for other purposes, such as with private endpoints or service endpoints, or be delegated to any other hosting plan or service."
*
However, if i make the Key Vault public to overcome my reference errors, my connections to Storage and Cosmos via service endpoints work fine

Also the solution to a previous question i raised regarding flex apps advised to add a service endpoint for storage to the subnet used by the flex function app:

"Service Endpoint for Storage. To ensure that your Function App subnet has a service endpoint for Microsoft.Storage, you can add the "Microsoft.Storage" service endpoint to your Function App subnet"

My questions:

1. Is it ok to use service endpoints with the subnet delegated for my flex function app?
2. What is the correct way for a vnet integrated flex function app to privately communicate with other Azure resources?