Access Key-vault in notebooks

[AdarshPanasri]

Hello Everyone, I have few secrets in my Key vault and want to access those in fabric notebook. I dont want users to have access to key vault. I can create SPN and use that to access the vault but for that I would need to authenticate using the credentials.

I am aware I can use the below utility but how does the authentication work in backend, do we need to provide some level of permissions on KV ?

mssparkutils.credentials.getSecret('https://<name>.vault.azure.net/', 'secret name')

[PanuO]

So summary of this: You cannot currently use Workspace Identity to grant access into Azure Key Vault. Well you can, but nothing supports it. You cannot run Notebook with Workspace Identity. Hope this feature would come quickly as this would improve the security of Notebooks.

[v-shex-msft]

Hi @AdarshPanasri ,

Any update on this? Did the above suggestions help with your scenario? if that is the case, you can consider Kudo or Accept the helpful suggestions to help others who faced similar requirements.

If these also don't help, please share more detailed information and description to help us clarify your scenario to test.

How to Get Your Question Answered Quickly 

Regards,

Xiaoxin Sheng

[APG]

As an alternative to SPNs you can use Workspace Identity to authenticate. You will need to provide some permissions on the key vault to the workspace identity, for example:

• the "Key Vault Secrets User" role if your key vault is configured to use RBAC
• or an access policy with get/list permissions on secrets if your key vault is configured to use access policies

If you don't want to use workspace identities you could also authenticate with the user that created the notebooks; of course you still need to grant roles/access policies to that user in the key vault

[frithjof_v]

Very interesting! That is really exciting. Have you tested it? I thought workspace identity was only for authenticating to ADLS at the moment, ref. the docs you linked to:

"Fabric workspaces with a workspace identity can securely read or write to firewall-enabled Azure Data Lake Storage Gen2 accounts through trusted workspace access for OneLake shortcuts. In the future, Fabric items will be able to use the identity when connecting to resources that support Microsoft Entra authentication."

Thanks.

[mrtnhd]

I am also interested in this. Would it be possible to provide some example code of how I use the workspace identity to access an Azure key vault in a Fabric notebook?

[AndyDDC · Accepted solution]

Hi @AdarshPanasri @can you try this blog and see if it fits your scenario? https://www.syntera.ch/blog/2023/10/18/how-to-access-azure-key-vault-secrets-from-fabric-notebook/

[umeshr]

This is great stuff to use key vault using individua's id to connect to key vault.

Still awaiting for solution to connect to key vault using Fabric's workspace identity.

Please let us know in case there is any solution available.