You need to assign the user the Key Vault Secrets Officer role.
In the Azure portal, type Key Vaults in the search box, select Key Vaults from the search results then select KeyVault11641655. Alternatively, browse to Key Vaults in the left navigation pane.
In the key vault properties, select Access control (IAM).
In the Add a role assignment section, click the Add button.
In the Role box, select the Key Vault Secrets Officer role from the drop-down list.
In the Select box, start typing User2-11641655 and select User2-11641655 from the search results.
Click the Save button to save the changes.

You need to enable the Web Application Firewall on the Application Gateway.
In the Azure portal, type Application gateways in the search box, select Application gateways from the search results then select the gateway named Homepage-AGW. Alternatively, browse to Application Gateways in the left navigation pane.
In the properties of the application gateway, click on Web application firewall.
For the Tier setting, select WAF V2.
In the Firewall status section, click the slider to switch to Enabled.
In the Firewall mode section, click the slider to switch to Prevention.
Click Save to save the changes.

Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftcompute

Reference:
https://docs.microsoft.com/en-us/azure/frontdoor/quickstart-create-front-door