Fabric Pipelines & Key Vault

Hi TePe 

You are right in that using a managed entity is the way to go. Once you have created the managed entity, if you go into your Azure Key vault and go under the IAN section, you can then grant the managed entity read permissions to your key vault. Once that is done you should then be able to connect successfully from your pipeline to your vault. 

Here are the steps I asked Chat GTP to create for me which you can use: https://chatgpt.com/s/t_6a62a42f324c81919573901afa2da22f 

Hi TePe ,

In Fabric it works in this way ,

1. you can create Azure Key Vault connection using OAuth only. 

2. chose the Key Vault supported connection type like ADLS, Azure Databricks etc., it does support other authentication mechanism like basic, SPN, SAS/PAT token, Account Key.

In azure side you can leverage Managed Identity for accessing Azure Key Vault, But in Fabric to create Key Vault connection currently it support OAuth only.

You can refer this article - https://learn.microsoft.com/en-us/fabric/data-factory/azure-key-vault-reference-configure#supported-connectors-and-authentication-types

You can submit an idea for Managed Identites here https://community.fabric.microsoft.com/t5/Fabric-Ideas/idb-p/fbc_ideas

Regards,

Srisakthi

This is a solid breakdown of the Workspace Identity approach, and honestly the cleanest fix for this exact circular dependency problem.

One thing worth flagging for anyone reading this later: Workspace Identity support isn't uniform across every activity type yet, so if the Web Activity itself doesn't support pulling from Key Vault directly via Workspace Identity in your scenario, a common workaround is to add a preceding activity (like a notebook or a separate lookup) that retrieves the secret first, then pass that value into the Web Activity dynamically. Worth checking the docs for the specific activity you're using before assuming it's wired in end to end.

Also seconding the Entra ID check — I've seen cases where Workspace Identity shows as "enabled" in the workspace settings but the actual identity object took a few minutes to propagate to Entra, so permissions assigned too early in Key Vault didn't take effect until a retry.

Hi TePe 
We would like to inquire whether have you got the chance to check the solutions provided by Prince0011 Srisakthi GilbertQ in community to resolve the issue. We hope the information provided helps to clear the query. Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.

Hi TePe 
Thanks for letting us know that you got access for keyVault.
If you have any other issues related to Fabric and PowerBI do reach out to Fabric Community.