#external app to user private key vault

1 messages · Page 1 of 1 (latest)

raven thistle
#

When you say "privately accessible key vault", do you mean that it does not allow public access or just that it's a Key Vault within your tenant?

pliant hearth
#

it does not allow public access

raven thistle
#

Depends on how it's hosted, some Azure-integrated applications or services can access a Key Vault by allowing "Trusted Azure Services" in the Key Vault Network Settings, otherwise your option is to allow access from the public IP address used by the application

#

If it's an app that you are hosting, like an App Service, you would configure vNet Integration

alpine kiln
# pliant hearth it does not allow public access

You've got a couple of options If you and external app have some sort of agreement, you can allow them to connect to the internal key vault.

  • You can provide them VPN access to your network, and they can access the resource over your VPN.
  • If they have their own Azure tenant/connectivity, they can request a private ip address be added to your key vault.
  • If neither of the above are options, you can grant them whitelisted access to the key vault from their public network address. (This could be on the resource itself, or you could require this to go though some sort of firewall device first)

All three ways, you'd need to provide them a Service Principal to login to the key vault in your tenant.

unborn gyro
#

You can create a private endpoint from their network to your resource/