Azure Key Vault Firewall and Private Endpoints

Configure Azure Key Vault Network Settings

Network Access Control and Private Connectivity

Azure Key Vault stores cryptographic keys, secrets, and certificates that protect your most sensitive data. Network settings on Key Vault act as a gatekeeper, deciding which networks and IP addresses can reach those secrets. To secure the vault, you implement three main controls: firewall rules, virtual network service endpoints, and private endpoints. Each control adds a layer of protection, and they work together to block unauthorized access while letting legitimate traffic through.

Firewall rules work like a bouncer at a club—they check the IP address of every request and only let it in if the address appears on an approved list. You configure the vault's DefaultAction to Deny, which blocks all traffic by default, then add authorized IP rules that specify which IP ranges (such as your office network or specific Azure services) are allowed to connect. You can set these rules through the Azure portal, the Azure CLI command az keyvault update --default-action Deny, or PowerShell with Update-AzKeyVaultNetworkRuleSet. The key principle here is deny-by-default: unless you explicitly allow an IP or range, the vault rejects the connection.

Virtual network service endpoints extend your Azure virtual network directly into Key Vault, allowing traffic to flow over Microsoft's private backbone instead of the public internet. To use this, you enable the Microsoft.KeyVault service endpoint on a subnet, then create a virtual network rule on the Key Vault that binds to that subnet. When the endpoint is active, you can disable public network access entirely, which isolates the vault from internet-based threats. This approach protects traffic moving between Azure services within the same region, ensuring that even traffic staying inside Azure never touches the public network.

Private endpoints provide the strongest isolation by assigning Key Vault a private IP address inside your own virtual network. Using Azure Private Link, traffic flows from your VNet through Microsoft's backbone to the vault—nothing ever touches the public internet. To set this up, you create a private endpoint in a delegated subnet and disable network policies on that subnet. Azure automatically registers DNS entries in a private DNS zone using the format privatelink.vaultcore.azure.net, so applications can reach the vault using its standard hostname while the traffic stays private. Private endpoints give you the finest control over who can reach your secrets and from where.

Monitoring and verification complete the picture by confirming that your network controls actually work. You enable diagnostic logs through Azure Monitor to capture NetworkAccessDenied and NetworkAccessGranted events every time the firewall or network rules allow or block a connection. These logs feed into Microsoft Sentinel for security analysis and alerting, while Microsoft Defender for Key Vault watches for unusual access patterns that might indicate an attack. Without this monitoring, you would have no way to know if a misconfiguration left your secrets exposed or if an attacker was attempting to probe your defenses.