I am trying to setup a connection to Azure Key Vault from my .NET app using the Azure.Security.KeyVault.Secrets nuget package.

I am using certificate authentication and have it tested using the Azure cli. I am able to fetch secrets without issue.

However, in my .Net app the request fails with the message:

“Client address is not authorized and caller is not a trusted service”

I believe this is because the KeyVault is set up to only be accessible via a Private endpoint, which the Azure cli uses and the .Net package does not. The network info headers seems to prove this.

The header from my .Net request:

x-ms-keyvault-network-info: conn_type=Ipv4;addr=removed;act_addr_fam=InterNetwork;

And from the cli request:

x-ms-keyvault-network-info: conn_type=PrivateLink;private_endpoint=removed;addr=removed;act_addr_fam=InterNetworkV6

Is there a way to configure the package to use the PE? I tried Uri for the PE instead of the the vault uri of the key vault and I get the same error.