topic Re: Disable 'Allow trusted Microsoft services to bypass this firewall' for Azure Key Vault in Administration & Architecture

Disable 'Allow trusted Microsoft services to bypass this firewall' for Azure Key Vault

rdadhichi — Tue, 21 Jan 2025 12:42:52 GMT

Currently even when using vnet injected Databricks workspace, we are unable to fetch the secrets from AKV if the 'Allow trusted Microsoft services to bypass this firewall' is disabled.
The secret is used a AKV backed secret scope and the key vault is private (public access disabled).

Our security requirement is to disable this and use private endpoints only. We have tried a few things like :
1. NCC configuration to create a private endpoint from databricks to key vault

2. Verifying the dns entries and nslookup from the notebook gives the correct private ip of the kv

Is this a limitation as we could not find any documentation that would help us disabling this without breaking things.
Official troubleshooting doc also asks to keep this enabled
Troubleshooting 403

Re: Disable 'Allow trusted Microsoft services to bypass this firewall' for Azure Key Vault

Alberto_Umana — Tue, 21 Jan 2025 12:58:49 GMT

Hi @rdadhichi,

Have you set "Allow access from" to "Private endpoint and selected networks" on the firewall?

Re: Disable 'Allow trusted Microsoft services to bypass this firewall' for Azure Key Vault

rdadhichi — Tue, 21 Jan 2025 14:16:10 GMT

There are no such settings.

We have Disabled Public access .
We have Private endpoints created for the KV in the same vnet and can do a successfull nslookup from a notebook in our workspace

Our requirement is to dsable the exception : ' Allow Trusted services....'

Please let me know if this is possible or not

Re: Disable 'Allow trusted Microsoft services to bypass this firewall' for Azure Key Vault

bauerbrett1 — Wed, 16 Apr 2025 12:52:21 GMT

Any update on this? Is it possible to disable the ' Allow Trusted services....' rule if you are using a private endpoint or whitelist certain IPs? Or is it required no matter what?