Disable 'Allow trusted Microsoft services to bypass this firewall' for Azure Key Vault

[rdadhichi]

Currently even when using vnet injected Databricks workspace, we are unable to fetch the secrets from AKV if the 'Allow trusted Microsoft services to bypass this firewall' is disabled.
The secret is used a AKV backed secret scope and the key vault is private (public access disabled).

Our security requirement is to disable this and use private endpoints only. We have tried a few things like :
1. NCC configuration to create a private endpoint from databricks to key vault

2. Verifying the dns entries and nslookup from the notebook gives the correct private ip of the kv

Is this a limitation as we could not find any documentation that would help us disabling this without breaking things.
Official troubleshooting doc also asks to keep this enabled
Troubleshooting 403 

[Alberto_Umana]

Hi @rdadhichi,

Have you set "Allow access from" to "Private endpoint and selected networks" on the firewall?

[rdadhichi]

There are no such settings.

We have Disabled Public access . 
We have Private endpoints created for the KV in the same vnet and can do a successfull nslookup from a notebook in our workspace


Our requirement is to dsable the exception : ' Allow Trusted services....'

Please let me know if this is possible or not