diff --git a/azurerm/resource_arm_key_vault.go b/azurerm/resource_arm_key_vault.go
index 39507f17111f..620fefbe91e4 100644
--- a/azurerm/resource_arm_key_vault.go
+++ b/azurerm/resource_arm_key_vault.go
@@ -215,7 +215,9 @@ func resourceArmKeyVaultCreateUpdate(d *schema.ResourceData, meta interface{}) e
 		}
 
 		virtualNetworkName := id.Path["virtualNetworks"]
-		virtualNetworkNames = append(virtualNetworkNames, virtualNetworkName)
+		if !sliceContainsValue(virtualNetworkNames, virtualNetworkName) {
+			virtualNetworkNames = append(virtualNetworkNames, virtualNetworkName)
+		}
 	}
 
 	azureRMLockMultipleByName(&virtualNetworkNames, virtualNetworkResourceName)
@@ -350,8 +352,10 @@ func resourceArmKeyVaultDelete(d *schema.ResourceData, meta interface{}) error {
 						return err2
 					}
 
-					networkName := id.Path["virtualNetworks"]
-					virtualNetworkNames = append(virtualNetworkNames, networkName)
+					virtualNetworkName := id.Path["virtualNetworks"]
+					if !sliceContainsValue(virtualNetworkNames, virtualNetworkName) {
+						virtualNetworkNames = append(virtualNetworkNames, virtualNetworkName)
+					}
 				}
 			}
 		}
diff --git a/azurerm/resource_arm_key_vault_test.go b/azurerm/resource_arm_key_vault_test.go
index 45bd8b5396c0..10872232d249 100644
--- a/azurerm/resource_arm_key_vault_test.go
+++ b/azurerm/resource_arm_key_vault_test.go
@@ -113,7 +113,7 @@ func TestAccAzureRMKeyVault_networkAcls(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "network_acls.0.bypass", "None"),
 					resource.TestCheckResourceAttr(resourceName, "network_acls.0.default_action", "Deny"),
 					resource.TestCheckResourceAttr(resourceName, "network_acls.0.ip_rules.#", "0"),
-					resource.TestCheckResourceAttr(resourceName, "network_acls.0.virtual_network_subnet_ids.#", "1"),
+					resource.TestCheckResourceAttr(resourceName, "network_acls.0.virtual_network_subnet_ids.#", "2"),
 				),
 			},
 			{
@@ -351,14 +351,22 @@ resource "azurerm_virtual_network" "test" {
   resource_group_name = "${azurerm_resource_group.test.name}"
 }
 
-resource "azurerm_subnet" "test" {
-  name                 = "acctestsubnet%d"
+resource "azurerm_subnet" "test_a" {
+  name                 = "acctestsubneta%d"
   resource_group_name  = "${azurerm_resource_group.test.name}"
   virtual_network_name = "${azurerm_virtual_network.test.name}"
   address_prefix       = "10.0.2.0/24"
-  service_endpoints    = ["Microsoft.KeyVault"]
+  service_endpoints    = ["Microsoft.KeyVault",]
+}
+
+resource "azurerm_subnet" "test_b" {
+  name                 = "acctestsubnetb%d"
+  resource_group_name  = "${azurerm_resource_group.test.name}"
+  virtual_network_name = "${azurerm_virtual_network.test.name}"
+  address_prefix       = "10.0.4.0/24"
+  service_endpoints    = ["Microsoft.KeyVault",]
 }
-`, rInt, location, rInt, rInt)
+`, rInt, location, rInt, rInt, rInt)
 }
 
 func testAccAzureRMKeyVault_networkAcls(rInt int, location string) string {
@@ -392,7 +400,7 @@ resource "azurerm_key_vault" "test" {
   network_acls {
     default_action             = "Deny"
     bypass                     = "None"
-    virtual_network_subnet_ids = ["${azurerm_subnet.test.id}"]
+    virtual_network_subnet_ids = ["${azurerm_subnet.test_a.id}", "${azurerm_subnet.test_b.id}"]
   }
 }
 `, template, rInt)
@@ -430,7 +438,7 @@ resource "azurerm_key_vault" "test" {
     default_action             = "Allow"
     bypass                     = "AzureServices"
     ip_rules                   = ["10.0.0.102/32"]
-    virtual_network_subnet_ids = ["${azurerm_subnet.test.id}"]
+    virtual_network_subnet_ids = ["${azurerm_subnet.test_a.id}"]
   }
 }
 `, template, rInt)