topic Re: Accessing Azure KeyVault secret for Fabric CopyData Action in Data Warehouse

Accessing Azure KeyVault secret for Fabric CopyData Action

coolie — Tue, 20 Feb 2024 08:27:48 GMT

This post descibes how to get a secret from Azure KeyVault and this works great. But is it possible to set a variable for CopyData (REST) action without using Notebook?

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

Anonymous — Tue, 20 Feb 2024 08:45:49 GMT

Hi coolie ,

Thanks for using Fabric Community.
I would like to understand what do you mean by "variable for CopyData (REST)" ?
Can you please help me in sharing these details, so I can guide you better.

If you are checking for Azure Key Vault feature in Data Factory Activities, then it will available soon.

You can refer this: What's new and planned for Data Factory in Microsoft Fabric - Microsoft Fabric | Microsoft Learn

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

coolie — Tue, 20 Feb 2024 08:47:22 GMT

Hi thanks for the reply. The action I am using is CopyData from web (REST) which requires a bearer token. I do not want this in plain text so have it stored in Azure KeyVault. I would like to set the source header authorization with the secret from Azure KeyVault. I am assuming this would be done via a previously set variable (as dynamic content).

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

Anonymous — Tue, 20 Feb 2024 08:56:27 GMT

Hi coolie ,

As I understand you are trying to copy data from rest api to lakehouse with the help of fabric pipelines.
Current challenge in your case is inorder to invoke rest api you required token ( i.e. Bearer token).

You can refer this forum conversation to get some idea -
Ingest data form a rest API with Oauth2 - Microsoft Fabric Community

Hope this helps.

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

NandanHegde — Tue, 20 Feb 2024 11:03:26 GMT

You can use Web activity to get details from Azure Key vault

Settings :

Connection details :

where Base URL : https://<<KVName>>.vault.azure.net/secrets/<<SecretName>>?api-version=7.0

Token audience URI : https://vault.azure.net

Azuthorization : YOu can use any one like org or SP etc

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

coolie — Tue, 20 Feb 2024 12:27:15 GMT

Thanks that looks promising. Where do I get TenantID, client ID and principal Key from?

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

NandanHegde — Tue, 20 Feb 2024 12:33:00 GMT

You would need to create a Service principal.

https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal

but you can also use your org account and org authentication

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

coolie — Tue, 20 Feb 2024 16:19:37 GMT

Great that worked with org thanks. However the source of the CopyData does not seem to be picking up the secret using: activity('AKV').output

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

NandanHegde — Tue, 20 Feb 2024 16:20:29 GMT

Hey,

The Service principal key is the client secret and plz follow the below steps:

https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal#option-3-create-a-new-client-secret

And you need to grant the App/service princiapl access on the key vault to read the secrets.

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

coolie — Tue, 20 Feb 2024 16:23:55 GMT

Thanks that helps. I used org settings in the end and edited my reply, so think we overlapped. I'm trying to get the result into the CopyData action now.

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

NandanHegde — Tue, 20 Feb 2024 16:26:48 GMT

Glad it helped!!!!

Thanks for using Fabric Community.

Do send Kudo and Accept as solution for others to benefit on the solution

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

Osama_Anwar — Wed, 21 Feb 2024 04:16:48 GMT

I'm attempting the same thing, but I'm getting the error below; I'm using Organization authentication.

I'm wondering if it's possible to construct a pipeline activity similar to the one we use in Synapse in Fabric by testing it while I'm on trial capacity.

Error

Operation on target Web1 failed: {"error":{"code":"BadParameter","message":"The specified version (7.0/https://<<xyz>>.vault.azure.net/secrets/test-key-vault-secret?api-version=7.0) is not recognized. Consider using the latest supported version (7.5)."}}

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

gbelzileartm — Wed, 29 May 2024 15:36:58 GMT

Problem I see here is you still need to keep a secret in your pipeline. Is there a way to access the keyvault using Managed Identity?

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

ToddChitt — Tue, 10 Jun 2025 02:12:09 GMT

Hello NandanHegde I cam across this accepted solution while trying to do this exact same thing: Get a Fabric Pipeline Web activity to retrieve a secret from an Azure Key Vault. But I'm getting errors. I suspect it might be due to the fact that I don't know where to plug in the settings for

Token audience URI : https://vault.azure.net

Can you help?

I see that in classic Azure Data Factory Web task there is a space for "Resource" and the value of "https://vault.azure.net" goes there, but I don't see either Resource or Token Audience URI in Fabric Web Task. What am I missing?

Thanks in advance.

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

NandanHegde — Tue, 10 Jun 2025 04:27:44 GMT

It is in the connection settings that you have that option

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

ToddChitt — Tue, 10 Jun 2025 12:59:53 GMT

I found it. And to clarify for potential future readers, as of this writing, that property is ONLY available in the NEW CONNECTION dialog box:

It is NOT available in the Edit Connection dialog box:

Commentary: Horrible user interface to use two different diagol boxes to set properties for a connection.

I have submitted an Idea to have this fixed here: Expose the Token Audience URI property for when ED... - Microsoft Fabric Community

If you are getting this far reading this thread, please go vote on the it.

Thanks.

Re: Accessing Azure KeyVault secret for Fabric CopyData Action

ToddChitt — Tue, 10 Jun 2025 13:04:41 GMT

Addendum:

After recreating my connection to include the Token Audience Uri property, Fabric simply takes that information and adds it as a Header: