title: Unable to Access Azure Key Vault from Function - Returns Forbidden
body: <p>I'm trying to get a secret from a key vault using an Azure function, but the key vault returns forbidden when I try to access it. Clearly I'm missing something, but I haven't been able to find another post with the same problem. Code below:</p>
  
  <pre><code>AzureServiceTokenProvider azureServiceTokenProvider = new AzureServiceTokenProvider();
  KeyVaultClient kvClient = new KeyVaultClient(new KeyVaultClient.AuthenticationCallback(azureServiceTokenProvider.KeyVaultTokenCallback));
  
  //(https://keyvaultname.vault.azure.net/)
  var keyVaultUrl = Environment.GetEnvironmentVariable("KeyVaultLocation"); 
  
  //(name of the secret)
  var vaultSecretKey = Environment.GetEnvironmentVariable("VaultSecretKey"); 
  
  var value = (await kvClient.GetSecretAsync(keyVaultUrl, vaultSecretKey)).Value;
  </code></pre>
  
  <p>I'm outputting exceptions to the log, and the last line where I await the value of the secret throws this exception: </p>
  
  <blockquote>
    <p>Operation returned an invalid status code 'Forbidden'.</p>
  </blockquote>
  
  <p>I have already registered the function in the key vault's access policies and given it permissions to get secrets, and I've enabled Managed Service Identity for the function. Is there something else I'm missing? I'm at a loss as to why the function can't access the vault.</p>