Error text: 403 from the vault with no useful body, often `Forbidden` with no RBAC action named.
Two different 403s:
1. **Network 403.** Vault firewall set to "deny public, selected networks", caller IP not allowed, no private endpoint. Fix: add the caller IP, or add a private endpoint in the caller's VNet. Azure services calling the vault need "Allow trusted services" enabled.
2. **RBAC 403.** Names a missing action like `Microsoft.KeyVault/vaults/secrets/getSecret/action`. Fix: grant Key Vault Secrets User.
Tell them apart: the network 403 has no action string. If the error names an action, it is RBAC. If it is a bare 403, it is network.
Private endpoint checklist:
- DNS resolves the vault name to the private IP (check with nslookup from the caller). If it resolves to the public IP, the private DNS zone link is missing.
- The endpoint is approved (Pending = traffic still blocked).
- NSG on the caller subnet allows 443 to the endpoint.
Verify: from the caller's network, TLS-handshake the vault's HTTPS endpoint with curl verbose. An HTTP 401 without auth is fine, it proves network. Connection timeout = network; 401 = network OK, now fix auth.