Error whitelisting subnet to Key Vault

Question

Error whitelisting subnet to Key Vault

Henri Pihkala 0

10 Mar 2025, 3:46 pm

I'm having trouble whitelisting a new subnet to my Key Vault. I've previously added other subnets from other vnets without any issue. For some reason, for this vnet and subnet I'm getting an error.

I'm in the Networking settings of my Key Vault (via 'Manage' button on Networking page). Note that I have previously added a few subnets successfully via the exact same procedure:

Screenshot 2025-03-10 at 16.19.27

I select the virtual network I want to add:

Screenshot 2025-03-10 at 16.38.10

I click "Add" and it appears in the list:

Screenshot 2025-03-10 at 16.39.35

When I click "Save" I get this error:

Screenshot 2025-03-07 at 20.41.00

I don't understand how come I don't have sufficient permissions, as I was able to add the other subnets AND I have the Owner role in both associated Subscriptions (the one where the Key Vault is, and the one where the Virtual Network is). Checking with "View my access" in the IAM tab for both resources:

Screenshot 2025-03-10 at 16.41.47

I also compared my roles/permissions to the other vnets that I WAS able to successfully add to the Key Vault, and there's no difference at all, so I don't understand why it's failing:

Screenshot 2025-03-10 at 16.45.47

SrideviM 755 Reputation points Microsoft External Staff

13 Mar 2025, 5:24 am
Hello Henri Pihkala,

I noticed that you have two Owner role assignments in the subscription where you're facing the issue. One is inherited at the subscription level, which should grant full access, while the other has a condition applied to a specific resource.

Even though you're an Owner, Azure applies conditions as additional restrictions, which could explain why this issue is happening only in this subscription. The conditional Owner role might be preventing certain actions, including the operation required to whitelist the subnet.

To resolve this, please try the following steps:

Review the conditional role in IAM settings to see if it restricts networking actions. If so, consider editing or removing the condition.

If your inherited Owner role already grants full access, the conditional role may not be necessary.

You can also try explicitly assigning the "Network Contributor" role to the Virtual Network, as some networking actions require specific permissions at the resource level.

After making these changes, refresh your credentials (log out and back in or run az login) and try again.

Hope this helps!

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.
SrideviM 755 Reputation points Microsoft External Staff

14 Mar 2025, 8:47 am

Hello Henri Pihkala,

We haven’t heard from you on the last response and was just checking back to see whether the suggestion to remove conditional Owner role worked or not. If issue still persists, please provide your contact details in private messages window so that we can connect offline, and I can assist you further.

1 answer

Your answer

SrideviM 755 Reputation points Microsoft External Staff

13 Mar 2025, 5:24 am

Hello Henri Pihkala,

I noticed that you have two Owner role assignments in the subscription where you're facing the issue. One is inherited at the subscription level, which should grant full access, while the other has a condition applied to a specific resource.

Even though you're an Owner, Azure applies conditions as additional restrictions, which could explain why this issue is happening only in this subscription. The conditional Owner role might be preventing certain actions, including the operation required to whitelist the subnet.

To resolve this, please try the following steps:

Review the conditional role in IAM settings to see if it restricts networking actions. If so, consider editing or removing the condition.

If your inherited Owner role already grants full access, the conditional role may not be necessary.

You can also try explicitly assigning the "Network Contributor" role to the Virtual Network, as some networking actions require specific permissions at the resource level.

After making these changes, refresh your credentials (log out and back in or run az login) and try again.

Hope this helps!

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.
SrideviM 755 Reputation points Microsoft External Staff

14 Mar 2025, 8:47 am

Hello Henri Pihkala,

We haven’t heard from you on the last response and was just checking back to see whether the suggestion to remove conditional Owner role worked or not. If issue still persists, please provide your contact details in private messages window so that we can connect offline, and I can assist you further.

Answer 1

Hello Henri Pihkala,

It looks like you have two Owner role assignments in the subscription. One is inherited at the subscription level, which should normally give full access, but the other one has a condition applied to a specific resource.

enter image description here

Even though you are an Owner, Azure enforces conditions as additional restrictions, which might be causing this issue. To resolve this, check if the conditional Owner role in IAM restricts any actions and edit or remove it if necessary.

If the issue persists even after removing conditional role assignments, check whether the ID “f8fd0c48-dc13-4fe4-xxxxxxxxxxxxxx” from your error message is linked to a service principal, application, or user in your tenant.

enter image description here

To identify whether that ID is related to any service principal or application or user, search for it in Overview of your Microsoft Entra tenant:

Go to Azure Portal -> Microsoft Entra ID -> Overview -> Enter ID in Search bar:

enter image description here

If the ID is associated with a service principal or application, note it's name and assign "Network Contributor" role to it under either subscription having ID 6e0f0965-4400-4050-xxxxxxxxx or silta-test-vnet virtual network:

Go to Azure Portal -> Subscriptions -> Select Subscription with above ID -> Access control (IAM) -> Add role assignment -> Select Network Contributor role -> Search for application name in members -> Add -> (Review + assign)

enter image description here

For more details, check similar issue in this Microsoft Q&A.

If that also did not work, try re-registering Microsoft.KeyVault resource provider under subscription where you are facing issue like this:

User's image

Hope this helps!

If this answers your query, do click Accept Answer and Yes for was this answer helpful. If you have any other questions or are still running into more issues, please let me know in "Comments" section.

Share via

Error whitelisting subnet to Key Vault

1 answer

Your answer