A deployed function suddenly returns 403 from Key Vault. What is the most likely cause?
Why D is the answer
The identity lacks permission on the vault
403 means the caller was authenticated but not authorized. Check role assignments.
In detail
- A 403 means the identity was refused.
- Check its permission on the vault.
- A 403 means the identity was refused.
Use case
An illustrative scenario, not a real incident.
A function suddenly gets 403 from Key Vault. Its identity lost access after a role change, so restoring the role fixes it.
See it in different ways
sequenceDiagram participant A as App with managed identity participant E as Microsoft Entra ID participant K as Key Vault A->>E: Request a token E-->>A: Token A->>K: Get secret K-->>A: Secret value
sequenceDiagram participant A as App participant C as App Configuration participant V as Key Vault A->>C: Reads settings and flags C-->>A: Key Vault reference A->>V: Reads the secret, with its managed identity V-->>A: Current value
flowchart LR S0["403 returned"] --> S1["Check the identity"] --> S2["Check its role"] --> S3["Grant access"]
Key point: A 403 from Key Vault points to permissions.
Why the other options are wrong
- A. The function runtime version is out of date
- A runtime version would not cause a 403.
- B. The vault holds too many secrets
- Vault size is not the cause.
- C. The vault is in a different region
- Region does not cause a permission error.