Allowing Azure SQL Database to Access Key Vault for TDE When Firewall Blocks Public Access

• A.Enable the Azure SQL Database server's firewall to allow Azure services to access the server.
• ✓ B.Configure the Key Vault firewall to allow trusted Microsoft services to bypass the firewall.
• C.Assign a user-assigned managed identity to the SQL server instead of a system-assigned identity.
• D.Change the Key Vault firewall to allow all networks.

Why B: The Key Vault firewall blocks all public network access, so even though the SQL server has the correct managed identity and role assignment, the connection is denied by the firewall. By enabling the 'Allow trusted Microsoft services to bypass this firewall' setting, Azure SQL Database (a trusted Microsoft service) can connect to the Key Vault without exposing it to the public internet. This is the required additional configuration to resolve the TDE access failure.

• ✓ A.Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings
• B.Configure a service endpoint for Microsoft.KeyVault on the SQL server's subnet
• C.Assign the SQL server's server identity the 'Contributor' role on the Key Vault
• D.Create a private endpoint for the Key Vault in the SQL server's virtual network

Why A: When Azure Key Vault has a firewall that blocks all public access, Azure services like SQL Database that need to access the key for TDE operations must be explicitly allowed. Enabling 'Allow trusted Microsoft services to bypass this firewall' permits the SQL server's managed service identity to authenticate and retrieve the CMK from Key Vault, even when public network access is denied. This setting is required because the SQL server, as a platform-as-a-service (PaaS) resource, does not reside in a virtual network by default and cannot use a private endpoint or service endpoint without additional networking configuration.

• ✓ A.Enable the Key Vault firewall to allow trusted Microsoft services
• B.Create a private endpoint for the SQL server to access the Key Vault
• C.Enable public network access on the Key Vault
• D.Assign the SQL server's managed identity the 'Reader' role on the Key Vault

Why A: When Azure Key Vault has its firewall enabled to deny all public network access, it blocks all traffic, including requests from Azure SQL Database. By enabling the 'Allow trusted Microsoft services' exception, Azure Key Vault permits specific Azure platform services (like Azure SQL Database) to bypass the firewall, provided the service authenticates using a managed identity with appropriate permissions. This setting is essential for TDE with CMK because the SQL server's system-assigned managed identity must reach the Key Vault to unwrap the encryption key, even when public access is disabled.

• ✓ A.Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings.
• B.Disable public network access on the Key Vault.
• C.Add the SQL Database server's system-assigned managed identity to the Key Vault access policy.
• D.Enable soft-delete on the Key Vault.

Why A: Azure SQL Database uses TDE with a customer-managed key stored in Key Vault. When the Key Vault has a firewall enabled, Azure SQL Database must be able to bypass that firewall to access the key. Enabling 'Allow trusted Microsoft services to bypass this firewall' is required because Azure SQL Database is a trusted Microsoft service that needs to reach the Key Vault endpoint for TDE operations, even when the firewall blocks public network access.

• A.Configure a private endpoint for the Key Vault and assign it to the SQL server's virtual network.
• B.Enable soft-delete on the Key Vault.
• ✓ C.Enable the 'Allow trusted Microsoft services to bypass this firewall' setting.
• D.Add a firewall rule to allow traffic from the Azure SQL Database's public IP address.

Why C: When Azure Key Vault is protected by a firewall that denies all public access, the Azure SQL Database service (a trusted Microsoft service) must be explicitly allowed to bypass the firewall to retrieve the customer-managed key for TDE operations. Enabling the 'Allow trusted Microsoft services to bypass this firewall' setting permits the SQL server's managed identity to authenticate and access the key vault without requiring a public IP address or network rule.

• A.Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.
• ✓ B.Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.
• C.Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.
• D.Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.

Why B: Azure SQL Database uses TDE with CMK stored in Azure Key Vault, and when the Key Vault firewall is enabled with virtual network service endpoints, Azure SQL Database must be able to bypass the firewall to retrieve the key. The 'Allow trusted Microsoft services to bypass this firewall' setting permits Azure services like Azure SQL Database, which are considered trusted by Microsoft, to access the Key Vault even when network restrictions are in place. This is the only configuration that satisfies the security policy while enabling the necessary encryption operations.