Core key vault firewall should not be set to "Allow public access from all networks" since this is the most permissive setting and not required for the TRE to function.