Enabling CMK on Fabric Workspaces

We have been provided with the following RCA from Microsoft this morning:

The issue is occurring at AKV's KeyClient.GetKeyAsync API to get Key metadata. Both platform and AKV Product team are jointly working on the fix. Hard validation occurring at KeyProperties.RecoveryLevel property is under the fix. Considering this under preview tag, unfortunately we could not provide any ETA on the fix now.

So there is (as suspected) a fundamental issue with CMK on Fabric at the moment. As this is a Preview feature I guess we just have to wait until it is addressed.

Hey, you need to create the key RSA type and make sure you give the role "Key Vault Crypto Service Encryption User" at the Fabric Platform CMK but at KEY LEVEL IS NOT at KeyVault level.

Hi, the key is RSA 2048 and I did try your suggestion, but it did not fix the issue, still get the exact same error message.

To be honest, I'm not 100% convinced you would be setting this role at the key level. As per the guide; Fabric only supports versionless customer managed keys, from the guide... Fabric checks the key vault daily for a new version, and uses the latest version available... 

This would indicate to me that the role should be set at the key vault, otherwise as soon as a new key is present all access would stop until the role was manually assigned to the new key. In addition, the guide does explicitly state that the role should be set at the key vault, prior to the creation of the RSA key.

Thanks for your suggestion though, it was worth a try.

hi,

I can confirm that you set the role at the KEY VAULT, you do not set it at KEY LEVEL. The process described in the guide works 100% as I have applied this myself by following the guide. The issue you have will be a conditional access policy preventing the process from completing. I would look at the CAP set by your admin as the message is not saying the setup is in error, it is saying the setup is correct but it cannot apply the CMK due to something else.

I encountered the same error message, and to avoid any guesswork, I recommend the following steps:

1. Enable the Log Analytics Workspace for the Key Vault.
2. Activate the AuditEvent setting.
3. Attempt to enable the Customer Managed Key (CMK) at the workspace settings level.
4. Once these steps are completed, check the AzureDiagnostics in the Logs. Pay special attention to the "KeyUnwrap" operation name, as it was instrumental in resolving my issue.

Additionally, ensure that you have correctly granted access to the Object ID of the Microsoft Fabric CMK application, rather than its App ID. Initially, I mistakenly provided access to the App ID using Terraform, which led to the error.

This was the the error I found in my logs when I was facing the same issue:

Caller is not authorized to perform action on resource.
If role assignments, deny assignments or role definitions were changed recently, please observe propagation time.
Caller: appid=XXXX-XX-XXXX-XXXX-XXXXXX;oid=XXXX-XXX-XX-XX-XXXXXXXX;iss=https://sts.windows.net/XXXXXX-XX-XX-XXX-XXXXXXXX/
Action: 'Microsoft.KeyVault/vaults/keys/read'
Resource: '/subscriptions/AAA-BBBBB-CCCC-DDD-EEEEE/resourcegroups/rg-fabric-dev/providers/microsoft.keyvault/vaults/kv-fabric-dev/keys/cmkfabrictest'
Assignment: (not found)
DenyAssignmentId: null
DecisionReason: null
Vault: kv-fabric-dev;location=youlocation

Hi mortoman,

We would like to follow up to see if the solution provided by the community member resolved your issue. Please let us know if you need any further assistance.

JMCK & igm87 , thanks for your prompt response.

Thanks,

Prashanth Are

MS Fabric community support

If our community member response resolved your issue, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

Hi mortoman,

We would like to follow up to see if your query got resolved? Please let us know if you need any further assistance.

Thanks,

Prashanth Are

MS Fabric community support

We would like to confirm if our community members answer resolves your query or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are happy to help you.

If we don’t hear back, we’ll go ahead and close this thread. For any further discussions or questions, please start a new thread in the Microsoft Fabric Community Forum we’ll be happy to assist.
Thank you for being part of the Microsoft Fabric Community.

Hi mortoman2,

Is there any update on your issue from support team. Please do post your progress here. this will help other community members with similar issues

Thanks,

prashanth