I have set up a Function app in azure. I have created a key vault in the same region. I set the function app to use system managed identity. I granted the KeyVaultReader and KeyVaultSecretsUser roles to the function app’s managed identity. (The Key vault is configured to use RBAC). When I define an application setting which should be able to use a Key Vault Reference, my supposition is that I should see an absence of errors in the listing on the Azure portal.

However, a status of AccessToKeyVaultDenied persists.

In case it is relevant, I am creating a nodejs function app using typescript

Assumptions I have verified:

• Key Vault and Function App are in the same region
• Key Vault “bypass … for trusted Azure …” firewall setting is enabled
• Function app is configured to use managed identity
• Virtual network integration is enabled for the function app with a specific funcapp subnet
• that same funcapp subnet is allowed in the key vault networking firewall settings

Things I have tried:

• granting additional roles wrt key vault to the function app’s managed identity (up to and including owner)

I am certain there is one key element I am overlooking that will rapidly resolve this, but my research into this problem hasn’t turned anything up.

For reference:

Specific Key Vault References (de-identified) tried:

@Microsoft.KeyVault(VaultName=myvault;SecretName=mysecret)