ExpressRoute customers can now store MACsec secrets (CAK and CKN) in an Azure KeyVault with Firewall Policies enabled. This enables you to restrict public access to your Azure KeyVault, while allowing ExpressRoute and other Microsoft Trusted Services to access any secrets, passwords, or keys stored in the KeyVault.
Learn more about Azure ExpressRoute.