Forum Discussion
Get secret from Key Vault Web Activity
Hi k_foxy,
To target a different environment (such as test or prod), you’ll need to create a new connection that points to the appropriate Key Vault for that environment.
Once created, you can update the Web activity in your pipelines to use the new connection accordingly.Since the connection URL can’t be parameterized at the moment, switching environments requires manually changing the connection reference in the pipeline.
If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.
Thank you.
Hi k_foxy,
Thank you for reaching out to the Microsoft Fabric Forum Community.
Based on the error message regarding the expired refresh token and the consistent failure regardless of the credentials entered while it may seem like the activity supports service principal credentials directly, it does not natively support the full OAuth 2.0 client credentials flow required to authenticate a service principal with Azure Key Vault. This explains why even with correct credentials, the connection attempt fails.
Try using a Managed Identity if your Fabric workspace supports it. This is the most seamless and secure method, as it allows Fabric to authenticate directly with Azure Key Vault without manually managing secrets. Ensure that the managed identity is granted the "Key Vault Secrets User" role at the Key Vault level, and configure the Web Activity with the correct Key Vault URL.
If Managed Identity is not an option, a reliable alternative is to create an Azure Function or Logic App that handles the OAuth token exchange using your service principal and retrieves the secret from the Key Vault. The Web Activity in Fabric can then call this function securely.
Additionally, double-check that the Tenant ID, Client ID, and Client Secret being used are accurate, not expired, and correspond to the registered application in Azure Active Directory. Also, ensure that the Key Vault’s network settings allow access from all networks, as you’ve mentioned, and that there are no additional access restrictions in place.
If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.
Thank you.
I was able to fix it, I was given incorect value for SP secret value.
The web activity allows me to connect to a dev keyvault, but how do I change it after deployment to test and prod. It cannot be parameterised so it is hardcocded to dev?
Hi k_foxy,
To target a different environment (such as test or prod), you’ll need to create a new connection that points to the appropriate Key Vault for that environment.
Once created, you can update the Web activity in your pipelines to use the new connection accordingly.Since the connection URL can’t be parameterized at the moment, switching environments requires manually changing the connection reference in the pipeline.
If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.
Thank you.