Forum Discussion
Managed Identities Security
Hi all,
Wanted to check if I am missing something here sorry. We are looking to secure Microsoft Fabric with Managed Identities and create Key Vault connections.
It appears that as it stands, when you create a Key Vault connection in Fabric it can only use standard OAuth2 with the users accounts (the one setting it up), and there's no option to use managed identities, Service Principals,
If this is right, it really feels like a significant oversight, especially when coupled with the secure futures initiative push.
can somebody please advise if I'm missing something here?
Kindest regards,
Phil
Hi Marshyp
Thanks for following up.
You are exactly right—currently, when creating Azure Key Vault references OAuth2 (user-delegated) is the only supported Authentication Method.
My best suggestion is to create the references to your Key Vaults using a service account and share it with security groups. This keeps maintenance to a minimum, following the same governance approach as personal cloud connections.
Alternatively, you can suggest other auth methods (like Managed Identity) for Key Vault references here: Fabric Ideas.
I do suspect the MS team is already looking into adding more auth methods, though!
Br,
Asger
5 Replies
Hey AsgerLB,
Apologies for not being clear, but you are correct - When we create a cloud connection and set the authentication method to Service Principle, we cannot fetch the secrets from Key Vault as the Service Principle, but only as the user making the connection (via OAuth2). There doesn't appear to be any option to use Service Principle, Managed Identity, etc.
Hi Marshyp
Thanks for following up.
You are exactly right—currently, when creating Azure Key Vault references OAuth2 (user-delegated) is the only supported Authentication Method.
My best suggestion is to create the references to your Key Vaults using a service account and share it with security groups. This keeps maintenance to a minimum, following the same governance approach as personal cloud connections.
Alternatively, you can suggest other auth methods (like Managed Identity) for Key Vault references here: Fabric Ideas.
I do suspect the MS team is already looking into adding more auth methods, though!
Br,
Asger
