Allowlist Outbound IPs for Key Vault

Add your agent's outbound IP addresses to a Key Vault firewall so certificate-based connectors can retrieve certificates.

Prerequisites

• An agent in Running state
• An Azure Key Vault with a firewall enabled (set to "Allow access from specific virtual networks and IP addresses")
• Key Vault Contributor or Network Contributor role on the Key Vault resource

Step 1: Find your agent's outbound IPs

1. In the agent portal, go to Settings → Basics.
2. Find the Outbound IP addresses row.

3. Click the copy icon next to each IP address to copy it to your clipboard.

tip

The same IPs also appear as an info banner when you configure a certificate-based connector. Either location works.

Step 2: Add IPs to your Key Vault firewall

1. Open the Azure portal.
2. Navigate to your Key Vault resource.
3. Select Networking from the left menu.
4. Under Firewalls and virtual networks, confirm Allow access from specific virtual networks and IP addresses is selected.
5. In the Firewall section, add each outbound IP address from Step 1.
6. Select Save.

Step 3: Verify the connection

1. Return to the agent portal.
2. Configure or re-test your certificate-based connector.
3. The connector should now retrieve certificates from the Key Vault without firewall errors.

Checkpoint

If the connector still fails after adding the IPs, verify:

• All IPs were added (not just the first one)
• The Key Vault firewall changes have been saved
• The agent's managed identity has the correct Key Vault role (Key Vault Secrets User or Key Vault Certificate User)

Next steps

• Network Requirements — full network configuration reference