Key Vault references fail if VNet integrated

Seems like Key Vault references fails if VNet integrated and firewall is enabled in the Key Vault, even though "Allow trusted Microsoft services to bypass this firewall" is set to yes.

We're trying to get secrets from a PowerShell function app using Key Vault references. Key Vault references worked perfectly before we VNet integrated the Key Vault.

Is this a known issue, or are we doing something obviously wrong?

Here are som anonymized screenshots, including log from Key Vault.

* Key Vault \ Access policies

* Key Vault \ Firewall and virtual networks

* Log Analytics to query Key Vault logs