Virtual network service endpoints for Azure Key Vault

The virtual network service endpoints for Azure Key Vault allow you to restrict access to a specified virtual network. The endpoints also allow you to restrict access to a list of IPv4 (internet protocol version 4) address ranges. Any user connecting to your key vault from outside those sources is denied access.

There is one important exception to this restriction. If you opt in to allow trusted Microsoft services, certain Microsoft services bypass the firewall and can reach the vault. The Trusted services section later in this article lists the services that bypass the firewall today; services that aren't in that table need a firewall IP rule, a virtual network rule, or a private endpoint to reach the vault. Services that bypass the firewall still need to present a valid Microsoft Entra token and must have permissions (configured as Azure RBAC role assignments or access policies) to perform the requested operation. For more information, see Virtual network service endpoints.

Usage scenarios

You can configure Key Vault firewalls and virtual networks to deny access to traffic from all networks (including internet traffic) by default. You can grant access to traffic from specific Azure virtual networks and public internet IP address ranges, allowing you to build a secure network boundary for your applications.

Here are some examples of how you might use service endpoints:

• You are using Key Vault to store encryption keys, application secrets, and certificates, and you want to block access to your key vault from the public internet.
• You want to lock down access to your key vault so that only your application, or a short list of designated hosts, can connect to your key vault.
• You have an application running in your Azure virtual network, and this virtual network is locked down for all inbound and outbound traffic. Your application still needs to connect to Key Vault to fetch secrets or certificates, or use cryptographic keys.

Grant access to trusted Azure services

You can grant access to trusted Azure services to the key vault, while maintaining network rules for other apps. These trusted services will then use strong authentication to securely connect to your key vault.

You can grant access to trusted Azure services by configuring networking settings. For step-by-step guidance, see Configure network security for Azure Key Vault.

When you grant access to trusted Azure services, you grant the following types of access:

• Trusted access for select operations to resources that are registered in your subscription.
• Trusted access to resources based on a managed identity.
• Trusted access across tenants using a Federated Identity Credential

When Allow trusted Microsoft services to bypass this firewall is enabled, services listed in the Trusted services table can reach the vault. The bypass continues to apply when public access is disabled, so listed services don't require a private endpoint to connect. If public network access is set to Secure by perimeter (via association with a Network Security Perimeter), the bypass is overridden and even trusted services are blocked unless an explicit perimeter access rule admits them.

Trusted services

The following table lists the Microsoft services known to bypass the Key Vault firewall when the Allow trusted services option is enabled. This table reflects services known at the time of publication; newly onboarded services may not yet appear here.

Next steps

• For step-by-step instructions, see Configure network security for Azure Key Vault.
• For security best practices, see Secure your Azure Key Vault.