topic Re: Azure Keyvault integration to Fabric Data Factory in Pipelines

Azure Keyvault integration to Fabric Data Factory

girishtharwani2 — Thu, 19 Dec 2024 06:42:30 GMT

I am looking for a way to integrate Azure Key Vault into Fabric Data Factory pipelines. Unfortunately, I haven't had any success so far. Any suggestions on how to achieve this integration?

Thanks,

Girish

Re: Azure Keyvault integration to Fabric Data Factory

NandanHegde — Thu, 19 Dec 2024 06:54:06 GMT

When you state integration of Key vault in fabric data pipelines, can you please state whether it is in the ocnnections or within the pipeline?

Unfortunately, KV integration within connections is not available as of today.

Within pipelines, you can use web activity and KV rest API to get the secert values

Re: Azure Keyvault integration to Fabric Data Factory

Anonymous — Tue, 24 Dec 2024 05:20:16 GMT

Hi girishtharwani2

Thanks for reaching out in Microsoft Community Forum

Key Vault integration with Fabric data factory is not available but within pipelines you can use webactivity and key vault REST API to get secret values

To retrieve secret values from Azure Key Vault within a Fabric Data Factory pipeline using Web Activity and Key Vault REST API, follow these steps:

Step 1: Grant Permissions to Access Key Vault

Go to the Azure portal and navigate to your Azure Key Vault.

Assign appropriate permissions

step 2; If using Managed Identity, ensure the Fabric Data Factory's Managed Identity has Get access on secrets.

If using Service Principal, grant similar permissions to the Service Principal.

step 3; Obtain the Key Vault REST API URL

The base URL for Key Vault REST API is: https://<YourKeyVaultName>.vault.azure.net/

To access a specific secret, append the secret name: https://<YourKeyVaultName>.vault.azure.net/secrets/<SecretName>?api-version=7.3

step 4; Configure Web Activity in Fabric Data Factory

URL: Enter the Key Vault secret URL (https://<YourKeyVaultName>.vault.azure.net/secrets/<SecretName>?api-version=7.3).

Method: Set to GET.

Authentication:

For Managed Identity:

Select the Managed Identity option.

Ensure the Managed Identity has access to the Key Vault.

For Service Principal:

Obtain an Access Token from Azure AD and pass it in the Authorization header.

Add a header with the following key-value pair: Authorization: Bearer <AccessToken>

Step 5: Get an Access Token (If Using Service Principal)

Add a separate Web Activity to retrieve an Azure AD token using the OAuth 2.0 token endpoint:

URL: https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/token

Method: POST

Body:

{

"grant_type": "client_credentials",

"client_id": "<ServicePrincipalClientID>",

"client_secret": "<ServicePrincipalSecret>",

"scope": "https://vault.azure.net/.default"

}

Headers:

Content-Type: application/x-www-form-urlencoded

5.Capture the token response in the output of this activity.

6. Link Access Token to Key Vault Web Activity

In the Key Vault Web Activity, use the output of the token retrieval activity for the Authorization header:

Use dynamic content to reference the token: @concat('Bearer ', activity('GetTokenActivityName').output.access_token)

7. Use Retrieved Secret Value

The Key Vault API returns the secret value in the value property of the JSON response.

Pass this output dynamically to subsequent pipeline activities: @activity('GetSecretActivityName').output.value

If you found this post helpful, please consider marking it as "Accept as Solution" to help other members find it more easily.

Thanks,

Pavan.

Re: Azure Keyvault integration to Fabric Data Factory

Anonymous — Fri, 27 Dec 2024 04:28:29 GMT

Hi girishtharwani2 ,

I wanted to follow up since we haven't heard back from you regarding our last response. We hope your issue has been resolved.
If the community member's answer your query, please mark it as "Accept as Solution" and select "Yes" if it was helpful.
If you need any further assistance, feel free to reach out.

Thank you,
Pavan.

Re: Azure Keyvault integration to Fabric Data Factory

GarryH — Wed, 02 Apr 2025 07:03:15 GMT

What do you do if it is ServicePrincipalSecret that you are trying to retrieve from the key vault?

Re: Azure Keyvault integration to Fabric Data Factory

ToddChitt — Wed, 04 Jun 2025 20:27:03 GMT

Hello Anonymous

I came across this post while trying to get a Fabric Pipeline Web activity to connect to an Azure Key Vault and retireve a Secret Value. I am having trouble:

You state: "step 2; If using Managed Identity, ensure the Fabric Data Factory's Managed Identity has Get access on secrets.

If using Service Principal, grant similar permissions to the Service Principal."

Fabric Data Factory's Managed Identity? Where is that? Is that the Workspace Identity from Workspace Settings?

For step 4, you state that for Managed Identity...

But that is not an option in Web Activity's Connection Properties. For Authentication Kind, I see: Anonymous, Basic, and Service principle.

What am I missing?