A larch-resin pot Function has Key Vault references configured but still receives 403 when resolving secrets. What is the likely missing piece?
Select an answer to reveal the explanation.
Short Explanation
References are only half the story—the Function’s identity still needs secrets get on the vault. A 403 usually means “badge missing,” not “wrong SKU.” Prefer RBAC (current default) or an access-policy get on older vaults.
Full Explanation
Key Vault references and SDK calls fail with authorization errors when the caller’s managed identity lacks data-plane permission. Assign an appropriate RBAC role such as Key Vault Secrets User, or a get access policy when the vault still uses the access-policy model. Disabling identity or moving secrets into telemetry does not authorize vault access.