Forum Discussion
How to store secrets/access secrets using User Data Functions
Hi,
I'm intersted in using the new User Data Function functionality, but I don't see any way to store secrets securly (think an API key, etc). How can I do so?
Hi cstoddard
Thank you for posting in the Microsoft Fabric Community. Also thankyou lbendlin for your inputs.To securely store and access secrets within User Data Functions (UDFs) in Microsoft Fabric, the best approach is to integrate Azure Key Vault (AKV) with Managed Identities. This ensures that sensitive information, such as API keys, is never hardcoded in your UDFs.
First, enable Managed Identity for your Fabric workspace, then grant it the "Key Vault Secrets User" role in AKV. This allows Fabric to authenticate securely and retrieve secrets without needing to store credentials in code.
If Managed Identities are not available in your setup, an alternative is using environment variables to securely store authentication details. Avoid hardcoding secrets at all costs, as it poses security risks.
For detailed guidance on securing credentials in Microsoft Fabric, refer to Microsoft Docs on Fabric Security. This approach follows security best practices and ensures your API keys and other sensitive data remain protected.
If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thankyou.
12 Replies
Hi cstoddard
Thank you for posting in the Microsoft Fabric Community. Also thankyou lbendlin for your inputs.To securely store and access secrets within User Data Functions (UDFs) in Microsoft Fabric, the best approach is to integrate Azure Key Vault (AKV) with Managed Identities. This ensures that sensitive information, such as API keys, is never hardcoded in your UDFs.
First, enable Managed Identity for your Fabric workspace, then grant it the "Key Vault Secrets User" role in AKV. This allows Fabric to authenticate securely and retrieve secrets without needing to store credentials in code.
If Managed Identities are not available in your setup, an alternative is using environment variables to securely store authentication details. Avoid hardcoding secrets at all costs, as it poses security risks.
For detailed guidance on securing credentials in Microsoft Fabric, refer to Microsoft Docs on Fabric Security. This approach follows security best practices and ensures your API keys and other sensitive data remain protected.
If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thankyou.
I don't believe this works. I set up the workspace identity in my Fabric workspace and then gave it Secret Officer permissions in AKV. When trying to connect with Fabric UDFs using the Azure Key Vault SDK, it couldn't authenticate probably because UDFs do not leverage the managed identity of the workspace. I tested calling the function from a notebook and using mssparkutils to retrieve the AKV secret and pass it to the function. Even though it shows the secret as redacted in the notebook, I can't tell if the function also receives the secret redacted. I cannot see the function logs once it's executed so can't validate.
Agreed. After much testing - UDFs do not inherit any workspace/author/user identity. There is no way to use for tokens. Other than using plain text api keys directly in the UDF code, or possibly setting them into the env os variables - which is insane, since both export plain-text via XMLA and persist into repos.
lbendlin - Notebooks inherit the author identify, and use that to get tokens. No such luck in UDFs.
Hi cstoddard ,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.Hi @cstoddard ,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.
What kind of keyvault are you considering? Accessing Azure Key Vault Secrets from Fabric Notebooks
