# Fix: AccessToKeyVaultDenied when using KeyVault with Function App application setting

https://blog.cynexia.com/fix-accesstokeyvaultdenied-when-using-keyvault-with-function-app-application-setting

Author: [Rob Aleck](https://blog.cynexia.com/pages/about) · https://github.com/mnbf9rca · https://www.linkedin.com/in/robertaleck/ · https://family-foqos.app/

Published: 2020-09-01
Categories: Fix


After following the instructions on the MS website to establish a [KeyVault reference](<https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references>) and place that in my App Settings, I [set up a Managed Service Identity and grant that identity access to my KeyVault key](<https://docs.microsoft.com/en-us/azure/key-vault/general/managed-identity>). Next, wishing to follow Microsoft's [advice](<https://docs.microsoft.com/en-us/azure/key-vault/general/best-practices>) and secured a [firewall around the KeyVault](<https://docs.microsoft.com/en-us/azure/key-vault/general/network-security>), ensuring that I checked the `Allow trusted Microsoft services to bypass this firewall?` setting, however, I was still receiving an `AccessToKeyVaultDenied` error:

![Screen shot showing that System assigned managed identity is receiving the AccessToKeyVaultDenied error with the explanation](https://blog.cynexia.com/attachments/fix-accesstokeyvaultdenied-when-using-keyvault-with-function-app-application-setting/576ca-screenshot-2020-09-01-at-10.05.28.png)

I even checked and yes, [App Service is supposed to be able to bypass the firewall](<https://docs.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints#trusted-services>) - so what was going on? Well, on the [KeyVault resolver reference page](<https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references>) it has this text:

`Key Vault references are not presently able to resolve secrets stored in a key vault with network restrictions.`

That seemed ok when i first read it as after all, there's an explicit setting to bypass the firewall. But when i disabled network firewall (allow access from `all networks`), everything suddenly worked, and the key status is `Resolved` with a nice green tick:

![Screen shot showing that the KeyVault key status is &quot;Resolved&quot;](https://blog.cynexia.com/attachments/fix-accesstokeyvaultdenied-when-using-keyvault-with-function-app-application-setting/334c0-screenshot-2020-09-01-at-10.14.11.png)