Forum Discussion
Fabric - Airflow Jobs - Notebook Access to Key Vault -mssparkutils.credentials.getSecret returns 403
Hi kaouter,
As we discussed on Discord, Fabric uses the security context of the identity that calls the API to trigger the notebook to access the keyvault.
In your case, when you have an airflow SPN triggering the notebook, that SPN is the identity that needs permissions on the keyvault for the notebook to be able to successfully authenicate to the keyvault.
It was great connecting with you on Discord and being able to help!
Super UserHi kaouter,
As we discussed on Discord, Fabric uses the security context of the identity that calls the API to trigger the notebook to access the keyvault.
In your case, when you have an airflow SPN triggering the notebook, that SPN is the identity that needs permissions on the keyvault for the notebook to be able to successfully authenicate to the keyvault.
It was great connecting with you on Discord and being able to help!
Hi everyone,
Quick update to close this out.
We ended up granting Key Vault permissions directly to the SPN that Airflow uses to trigger the notebook. Once the SPN had the Key Vault Secrets User role assigned, everything worked.
Thanks to everyone who jumped in on this thread, and a special shoutout to Taylor, your root cause breakdown was really helpful.
One thing I’d love to see from Microsoft in the future: when a notebook is triggered externally via a SPN, it should be possible to configure it to run under the Workspace Managed Identity instead. This would be the cleaner approach from a security standpoint : Airflow stays responsible for orchestration only, the SPN never touches the data or the secrets, and the notebook runs under a Workspace Identity that already has the right Key Vault permissions. Clean separation between the orchestration layer and the data layer.
Right now that separation isn’t possible when triggering notebooks directly via the Fabric API, which forces you to give Key Vault access to the orchestration SPN (not ideal).
Hope this thread helps someone else. Thanks again everyone!
