Creation

Create a "Key Vault" with the default settings:

Make sure that the permission model is set to "Azure role-based access control".

Then add your account to the resource in the "Key Vault Administrator" role:

Then create a new Key called “dataprotection”:

Network settings

Basically, the service works with this setting "Allow public access from all networks". This is the easiest way to create the key in particular.

If you activate "Allow public access from specific virtual networks and IP addresses", make sure that you add the Azure services yourself. Further information can be found here.