How to migrate a keyvault private endpoint to a new subnet

Jeff Strupp 20 Reputation points
2023-06-01T16:39:37.9866667+00:00

I have a private endpoint in a subnet that the operation team would like to reclaim. I have another subnet I can create a private endpoint in, but want to know the steps in replacing a private endpoint and if that requires any downtime for the keyvault service.

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,184 questions
Azure Private Link
Azure Private Link
An Azure service that provides private connectivity from a virtual network to Azure platform as a service, customer-owned, or Microsoft partner services.
492 questions
Azure Life and Safety
Azure Life and Safety
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Life and Safety: A Microsoft program that helps Life and Safety customers adopt to Microsoft Cloud solutions.
1 question
0 comments
Accepted answer
  1. JamesTran-MSFT 36,541 Reputation points Microsoft Employee
    2023-06-01T20:53:20.4033333+00:00

    @Jeff Strupp

    Thank you for your post!

    I understand that you currently have a Private Endpoint that your Operations team would like to reclaim. You can create another Private Endpoint to replace this, but to account for any downtime when it comes to replacing/switching these two Private Endpoints, you'd like to know the steps to replace a Private Endpoint within the Azure Key Vault.

    Assuming you have a VNET, subnet in that VNET, and the correct RBAC permissions for the VNET and Key Vault - to replace a private endpoint within your Key Vault, you'll need to:

    1. Establish a private link connection to your existing key vault.
    2. Validate that the new private link connection works.
    3. Once you've confirmed that the new private endpoint is working correctly, you can remove the original private endpoint.

    User's image

    As for downtime, it's possible that there may be a brief interruption while you're updating and testing the new private endpoint, but this should be minimal if everything is configured correctly. I'd also recommend trying to perform these operations during a maintenance window or low-traffic period.

    I've also reached out to our Key Vault engineering team to confirm this and will update as soon as possible.

    Additional Links:

    I hope this helps!

    If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest