Status: OUT
App Service can achieve fully network-isolated secret injection: Key Vault references inject secrets via managed identity from a vault whose defense-in-depth key lifecycle (tiered FIPS protection, three-layer deletion safeguards) is completely isolated from public internet through Private Link's triple isolation model — secrets flow from HSM to application runtime without traversing any public network path.