Today, only Oauth 2.0 (user account) is supported as authentication option when setting up an Azure Key Vault reference.
Please add support for
- Workspace Identity
- Service principal
- User assigned managed identity
9 Comments
- This is a good idea, Service principal or user assigned managed identity will be a great help. Workspace identity will be difficult i think because it is a global key vault reference and not workspace specific.
PeterDanielsAdvocate III
We REALLY need a way to set up Azure Key Vault references without using a regular user/member account. Please. WI would be even better, but a service principal/app-reg would be a great start.- Without this organizations are not feeling that keyvault references are the answer and are turning more towards notebooks and calling keyvault via api’s. Microsoft would benefit from a larger adoption of the feature in a faster manner and could get better feedback from partners.
- Anyone at Microsoft, can you please solve this basic problem before adding more bells and whistles?
- Upvoting for different authentication methods as my token randomly expired earlier this week and broke a lot of pipelines that had connections using secrets from this key vault reference.
Tying Azure Key Vault references to an individual user’s OAuth sign-in doesn’t work for enterprise deployments. When the person who created the reference changes teams, leaves the company, has their password reset, or is simply on vacation when their token expires, every connection relying on that reference fails, and refreshes across the organization stop until someone notices.
The cleanup cost is just as real. Every time a personal credential lapses, someone has to track down what broke and update connections one by one. In an enterprise tenant, that can mean hundreds of connections and semantic models, hours of admin time spent on work that should never have been necessary, and outages for the business while it happens.
This pattern keeps recurring across Fabric features: designs that work well for a single developer but break down at enterprise scale. Standard practice for production workloads is to authenticate with non-personal identities, such as service principals or managed identities, so that critical functionality doesn’t depend on any one person’s account.
Fabric is positioned as an enterprise platform. Please add service principal, workspace identity, and user-assigned managed identity support for Key Vault references, and build that support into new features from the start. Announcing a feature makes a good headline, but if it can’t be used safely in a production enterprise environment, it isn’t really finished. Many of us have spent years working around credentials tied to individual users, and we looked to features like this to finally fix that. Instead, it repeats the same problem.
