How to store secrets/access secrets using User Data Functions

[cstoddard]

Hi,

I'm intersted in using the new User Data Function functionality, but I don't see any way to store secrets securly (think an API key, etc). How can I do so?

[v-tsaipranay · Accepted solution]

Hi @cstoddard 
Thank you for posting in the Microsoft Fabric Community. Also thankyou @lbendlin  for your inputs.

To securely store and access secrets within User Data Functions (UDFs) in Microsoft Fabric, the best approach is to integrate Azure Key Vault (AKV) with Managed Identities. This ensures that sensitive information, such as API keys, is never hardcoded in your UDFs.

First, enable Managed Identity for your Fabric workspace, then grant it the "Key Vault Secrets User" role in AKV. This allows Fabric to authenticate securely and retrieve secrets without needing to store credentials in code.

If Managed Identities are not available in your setup, an alternative is using environment variables to securely store authentication details. Avoid hardcoding secrets at all costs, as it poses security risks.

For detailed guidance on securing credentials in Microsoft Fabric, refer to Microsoft Docs on Fabric Security. This approach follows security best practices and ensures your API keys and other sensitive data remain protected.

If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.

Thankyou.

[agarrido_fabric]

I don't believe this works. I set up the workspace identity in my Fabric workspace and then gave it Secret Officer permissions in AKV. When trying to connect with Fabric UDFs using the Azure Key Vault SDK, it couldn't authenticate probably because UDFs do not leverage the managed identity of the workspace. I tested calling the function from a notebook and using mssparkutils to retrieve the AKV secret and pass it to the function. Even though it shows the secret as redacted in the notebook, I can't tell if the function also receives the secret redacted. I cannot see the function logs once it's executed so can't validate.   

[v-tsaipranay]

Hi @cstoddard ,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[v-tsaipranay]

Hi @cstoddard ,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[v-tsaipranay]

Hi @cstoddard ,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[lbendlin]

What kind of keyvault are you considering?  Accessing Azure Key Vault Secrets from Fabric Notebooks

[cstoddard]

What? This doesn't answer the question at all.

[lbendlin]

Incorprorate calls to AKV into your UDFs.

[cstoddard]

I thought of this, but there is no way to keep my AKV credentials secret either. I would have to hardcode the values, unless there is an API that I'm missing.