I’m unable to have Azure API Manager (apim) to retrieve certiticate from a privatelink enabled KeyVault.

APIM:

• Vnet – internal
• Using User Assigned Managed Identity

KeyVault:

• Privatelink
• No Firewall

I need the apim to use the privatelink of the keyvault instead of the public endpoint, which is blocked. But apim won’t use the privatelink.

Using a system-managed identity on apim and having an exception for “Allow trusted Microsoft services to bypass this firewall” enabled works. But it’s a pain to use a system assigned managed identity, since creating rbac-permissions must be done after creating apim, then deploy a second time to configure custom domain names on apim.

I can’t seem to find a way to use User assigned managed identity on apim, without having the KeyVault publicly open, which is not an option for me.