Function App Connectivity Issue with Key Vault

Hi @Ankit Dwivedi

Thank you for reaching out to Microsoft Q&A.

When you use the Test/Run option for an Azure Function from the Azure portal, the request is executed from your browser (portal.azure.com). This requires two things to work:

1. the browser must be allowed to call the Function App endpoint (CORS), and
2. the browser must be able to network‑reach the Function App.

In scenarios where the Function App is secured using Private Endpoints, VNet integration, access restrictions, or service endpoints, the Function App is no longer reachable from the public internet. Even if CORS is configured correctly, the Azure portal cannot reach the Function App because there is no public network path. As a result, the portal test fails with a generic “Failed to fetch / TypeError” error. This is expected behavior and not an issue with your function code, Managed Identity, or Key Vault configuration. When Key Vault is also secured with a Private Endpoint, this further confirms that the Function App is designed to run only inside the virtual network, while the Azure portal test experience runs outside that network.

Refer below points to resolve this issue or use as a workaround:

Understand the platform limitation The Azure portal Test/Run feature is not supported for Function Apps that are private-only (Private Endpoint or restricted public access). This is by design. CORS controls browser permissions, not network connectivity, so adding portal.azure.com to CORS alone will not fix the issue.

Test the function from within the VNet Trigger the function from a resource that has network access to the Function App, such as:

• A VM or jump box inside the same VNet
• Azure Bastion + curl/Postman from the VM
• API Management, Logic Apps, or another Azure service with VNet integration

This is the recommended and production-safe testing approach.

Use Application Insights for validation Instead of portal Test/Run, rely on Application Insights:

• Check Traces, Requests, and Failures
• Trigger the function from the real source (HTTP client, Event Grid, Service Bus, etc.) and validate execution

Temporary public access for debugging (not recommended for production) If absolutely required for short-term debugging:

• Temporarily enable public network access
• Add https://portal.azure.com to CORS
• Test the function
• Re-disable public access immediately after testing

AzureCloud service tag clarification The AzureCloud service tag applies only when the Function App still exposes a public endpoint and uses Access Restrictions. It does not bypass Private Endpoint isolation. If Private Endpoint is enabled and public access is disabled, the portal will still be unable to reach the Function App.

Key takeaway If your Function App and Key Vault are working correctly at runtime but the Azure portal test fails, this confirms the network isolation is functioning as intended. Use in‑VNet testing methods for private and secure deployments methods for private and secure deployments.