When 'enabledfordiskencryption' is True, networkAcLs.bypass must include "Azure Services".

Question

When 'enabledfordiskencryption' is True, networkAcLs.bypass must include "Azure Services".

Satyam 25

User's image

I am trying to create a key vault and selected only the option Azure Disk encryption for volume encryption under Access policy.

For networking it was left to default i.e. all networks. But the deployment is failing for key vault. I have attached the screenshot of the error.

For reference I am following the process of "Create and encrypt a Windows virtual machine with the Azure portal"

Raja Pothuraju 47,420 Reputation points Microsoft External Staff Moderator

2024-08-13T21:04:01.61+00:00

Hello @Satyam,

Thank you for posting your query on Microsoft Q&A.

I am checking this and will get back to you with further inputs.

Thanks,
Raja Pothuraju.
Raja Pothuraju 47,420 Reputation points Microsoft External Staff Moderator

2024-08-18T17:20:48.0033333+00:00

Hello @Satyam,

Thank you for your time and patience.

It seems you're trying to create a Key Vault and encountered a 'BadRequest' error because 'enabledForDeployment' is set to true without including 'AzureServices' in 'networkAcls.bypass'.

To resolve this issue, I recommend modifying the network settings to 'selected networks', enabling 'allow trusted services', and then applying these changes to your environment.

Please let me know if this helps resolve the issue.

Thanks,
Raja Pothuraju.
Raja Pothuraju 47,420 Reputation points Microsoft External Staff Moderator

2024-08-20T02:05:28.4666667+00:00

Hello @Satyam,

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.
Raja Pothuraju 47,420 Reputation points Microsoft External Staff Moderator

2024-08-21T01:00:59.6866667+00:00

Hello @Sean Charles Pugosa,

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

1 answer

Your answer

Raja Pothuraju 47,420 Reputation points Microsoft External Staff Moderator

2024-08-13T21:04:01.61+00:00

Hello @Satyam,

Thank you for posting your query on Microsoft Q&A.

I am checking this and will get back to you with further inputs.

Thanks,
Raja Pothuraju.
Raja Pothuraju 47,420 Reputation points Microsoft External Staff Moderator

2024-08-18T17:20:48.0033333+00:00

Hello @Satyam,

Thank you for your time and patience.

It seems you're trying to create a Key Vault and encountered a 'BadRequest' error because 'enabledForDeployment' is set to true without including 'AzureServices' in 'networkAcls.bypass'.

To resolve this issue, I recommend modifying the network settings to 'selected networks', enabling 'allow trusted services', and then applying these changes to your environment.

Please let me know if this helps resolve the issue.

Thanks,
Raja Pothuraju.
Raja Pothuraju 47,420 Reputation points Microsoft External Staff Moderator

2024-08-20T02:05:28.4666667+00:00

Hello @Satyam,

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.
Raja Pothuraju 47,420 Reputation points Microsoft External Staff Moderator

2024-08-21T01:00:59.6866667+00:00

Hello @Sean Charles Pugosa,

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Answer 1

Elshan Mammadli 20

Hi @Raja Pothuraju

I can confirm that I had the same error and following your suggestion helped.

Steps I took:

I went to Key Valut>Netrowking and selected "Allow public access from specific virtual networks and IP addresses" After that checked the box below "Allow trusted Microsoft services to bypass this firewall"

Raja Pothuraju 47,420 Reputation points Microsoft External Staff Moderator

2024-09-18T23:48:24.8233333+00:00

Hello @Elshan Mammadli,

That’s great to hear! Thank you for sharing this information.
Zubair Ahmad 0 Reputation points

2025-08-19T17:50:13.0533333+00:00

I was able to fix by doing that as well. I would think 'allow all public IP' should take care of all microsoft services by default but no, Keyvault needed that specific setting and bypass microsoft.

Thank you @Elshan Mammadli

Share via

When 'enabledfordiskencryption' is True, networkAcLs.bypass must include "Azure Services".

1 answer

Your answer