Azure Key Vault 403 behind firewall or private endpoint

Error text: 403 from the vault with no useful body, often Forbidden with no RBAC action named.

Two different 403s:

1. Network 403. Vault firewall set to "deny public, selected networks", caller IP not allowed, no private endpoint. Fix: add the caller IP, or add a private endpoint in the caller's VNet. Azure services calling the vault need "Allow trusted services" enabled.
2. RBAC 403. Names a missing action like Microsoft.KeyVault/vaults/secrets/getSecret/action. Fix: grant Key Vault Secrets User.

Tell them apart: the network 403 has no action string. If the error names an action, it is RBAC. If it is a bare 403, it is network.

Private endpoint checklist:

• DNS resolves the vault name to the private IP (check with nslookup from the caller). If it resolves to the public IP, the private DNS zone link is missing.
• The endpoint is approved (Pending = traffic still blocked).
• NSG on the caller subnet allows 443 to the endpoint.

Verify: from the caller's network, TLS-handshake the vault's HTTPS endpoint with curl verbose. An HTTP 401 without auth is fine, it proves network. Connection timeout = network; 401 = network OK, now fix auth.

Proactive error-catalog skill. Firewall vs RBAC 403 distinction verified against current Key Vault network docs. Evidence: https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-python