Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The most restrictive option is to grant access only to the subnet that hosts the function app. First, enable the Microsoft.KeyVault virtual network service endpoint on AppSubnet, then add that subnet to the Key Vault's virtual network rules. Traffic from resources in the subnet is routed to the vault over the Azure backbone, and all other sources, including other Microsoft services, remain blocked.

Allowing trusted Microsoft services would open access for many Azure platforms you do not use. Relying on the function app's outbound IP addresses is fragile because those addresses can change and does not prevent other services using the same public IP range. Enabling public network access defeats the requirement to block other Azure services, even if a managed identity is used.