Does making an Azure key vault private still allow access to other resources in the same resource group?

Question

I am considering making a particular Azure key vault private (Access to key vault must only be allowed from approved VNET, On-Prem or public IP ranges)

Will this change result in the resources within the same resource group as the key vault losing access to it? Or will the other resources within the resource group still retain access and only the other external resources and IP addresses lose access?

Answer 1

Will this change result in the resources within the same resource group as the key vault losing access to it?

Likely yes.

Private endpoint != resource group.

Regardless of resource group, to be able to connect to a target private endpoint, the source resource needs a network path.

Being in the same resource group has no bearing on this.

For example for an Azure function to see a keyvault with a private endpoint, it needs to be attached to a VNET, and that VNET needs to be the same as (or peered / connected to) the VNET that the KeyVault private endpoint is on. Lastly all NSG's within the VNETs need to allow traffic on the correct port (443)

By introducing private endpoints, you suddenly need to start doing a bunch of network design.

This is assuming you don't have "Allow Azure Services to connect" ticked. However that tick box allows network access from any Azure resource (from any tenant not just yours) so it's not encouraged.