Azure Devops - enable access to keyvault

Question

I'm using the Microsoft Extension to access KeyVaults from Azure DevOps to fetch a secret from the vault. I'm getting this error message which appears to say that I need to allow rights the Azure Devops agent access to the keyvault. "Could not fetch access token for Managed Service Principal. Please configure Managed Service Identity (MSI) for virtual machine ' https://aka.ms/azure-msi-docs '. Status code: 400, status message: Bad Request""

I have this running on a separate test subscription where the AzureDevOps account has contributor access under Role Assignments, same on the PROD subscription where the error message is coming up.

Any insights would be greatly appreciated.

THanks,

Answer 1

This seems to be an issue with Azure keyvaults defined with service endpoints. As Azure DevOps is not a trusted service it does not have access to the endpoint. The workaround is to whitelist the ip of the agent right from the pipeline, removing it after you've obtained the secrets(figuring out how to do this now). This is referenced in here and here