function on consumption plan can be added "trusted services azure service" key vault behind firewall
would like to keep Azure key vault secure, at the same time that the Azure function on consumption plan can access the Key vault.
Jay Kay commented
...or add function apps in general to trusted services, as suggested here (please give it some votes):
As for FA on Consumption; the IPs may change at random, so there is no point in attempting to whitelist the FA in the KV Firewall.