Azure SQL TDE and Storage BYOK fail to unwrap keys after the lock-lab Key Vault firewall is set to Deny all. The services appear on Microsoft’s trusted services list. What else must the security engineer do?
Select an answer to reveal the explanation.
Short Explanation
Trusted Microsoft services is a network side door, not a free pass on permissions. Flip that bypass when the service is on the list, then still hand the identity Get/unwrap rights on the vault.
Full Explanation
Allowing trusted Microsoft services lets qualifying platform services reach Key Vault through the firewall when public access is otherwise restricted. That setting addresses network path only; the service’s managed identity or service principal still needs data-plane permission through Azure RBAC or a vault access policy. Opening All networks is a broader exposure than needed. Disabling Entra authentication or storing cleartext keys does not correctly solve Key Vault network-plus-authorization design.