Azure App Configuration Key Vault Reference (Private Key Vault)

Question

Azure App Configuration Key Vault Reference (Private Key Vault)

Atanu Gupta 196

Hi,

I am having a Key vault which is not publicly exposed keyvault

Adding Key vault reference to this Key vault in App Configuration giving error:

appconfig

Tried the managed identity way:

App Configuration settings

User's image

Key vault access policy configuration. 123

Please advise. 🙏 Thanks.

Note: My security team wont allow public Key Vault access.

Givary-MSFT 35,916 Reputation points Microsoft Employee Moderator

2024-06-13T05:57:20.8233333+00:00

@Atanu Gupta Thank you for reaching out to us, similar requirement has been discussed in this post - https://stackoverflow.com/questions/76680786/how-to-access-azure-key-vault-with-disabled-public-access-from-appservice just check if this helps to achieve your ask, feel free to revert back.
Atanu Gupta 196 Reputation points

2024-06-13T11:22:45.44+00:00

Actually No. The link shared is having App Service but in my case its Azure App Configuration
()

3 answers

Your answer

Givary-MSFT 35,916 Reputation points Microsoft Employee Moderator

2024-06-13T05:57:20.8233333+00:00

@Atanu Gupta Thank you for reaching out to us, similar requirement has been discussed in this post - https://stackoverflow.com/questions/76680786/how-to-access-azure-key-vault-with-disabled-public-access-from-appservice just check if this helps to achieve your ask, feel free to revert back.
Atanu Gupta 196 Reputation points

2024-06-13T11:22:45.44+00:00

Actually No. The link shared is having App Service but in my case its Azure App Configuration
()

Answer 1

Atanu Gupta 196

Still waiting for any solution here. Can anybody help or provide any direction? Or is it not at all possible to achieve.

0 comments

Answer 2

Akshay Kaushik 18,036 Microsoft Employee Moderator

@Atanu Gupta

App Configuration is not listed in Trusted services due to available customization.

Kindly try Granting your app access to Key Vault

DefaultAzureCredential automatically uses ManagedIdentityCredential when your app is running in Azure. You can use the same managed identity to authenticate with both App Configuration and Key Vault.

Create a system assigned identity and add access to the key Vault
Navigate to the KeyVault and Add private endpoint by choosing the Azure app configuration container followed by IP address of the VM to which system assigned identity is allocated:

User's image

Add this managed identity to your App configuration as well. Once done try adding the KeyVault reference

If you don't have any further queries and the suggestion above answers your ask, please "Accept the answer", This will help us and others in the community as well.

Thanks,

Akshay Kaushik

Atanu Gupta 196 Reputation points

2024-06-17T13:36:16.2933333+00:00

Thanks for replying.

There is no App or VM involved. Its just the Key Vault and App Configuration is there in the design.
Akshay Kaushik 18,036 Reputation points Microsoft Employee Moderator

2024-06-17T13:57:33.3033333+00:00

Thanks for your response. I understand from the above description that no VM is involved in actual design. But the workaround to use system assigned managed Identity would require you to setup an Azure VM which would grant access without allowing and public access on the key Vault. Thanks, Akshay Kaushik

Answer 3

K S, Shiva Kumar 0

Hi All,

Can someone share installation guide for azure key vault managed HSM.

Also please share how get the current configuration (export the current configuration settings )

0 comments