Using Key Vault secrets in Notebooks from Workspace identities

To use Workspace Managed Identity (WMI) instead of your user identity to access Azure Key Vault secrets from Notebooks in Microsoft Fabric, you need to ensure a few configuration steps are completed. Right now, your notebook is using your personal identity (your Entra ID object ID) rather than the workspace identity, which is why you're getting a 403.

Here’s how to fix it:

Grant Access to the Workspace Managed Identity in Key Vault

1. Your Key Vault needs to allow access for the workspace's identity.

2. In Azure Portal, go to your Key Vault.

3. Navigate to Access Control (IAM).

4. Add a role assignment:

a. Role: Key Vault Secrets User (or Key Vault Reader depending on access level).

b. Assign access to: Managed identity.

c. Select: Your Microsoft Fabric workspace identity.

Alternatively, if you're using access policies (not RBAC):

1. Go to Key Vault → Access policies.

2. Add an access policy:

a. Select Get secret permissions.

b. Under "Principal", select the Workspace Managed Identity.

Ensure Your Notebook Uses the Workspace Identity

The default behavior in Microsoft Fabric Notebooks is to use the user identity unless explicitly configured to use the Workspace identity.

To ensure the workspace identity is used:

• Use the correct Fabric-specific library/methods that support workspace identity. The typical notebookutils.credentials.getSecret(...) may default to your user identity.

Instead, you should use the Microsoft Fabric runtime feature that supports workspace identity by default for data access.

If notebookutils.credentials.getSecret(...) is intended to support workspace identity in Fabric, then Microsoft must have implemented it accordingly — however, if it still refers to your personal object ID (OID), then the identity used is your personal one.

Workaround:
As of now, Fabric does not allow switching identity in the middle of a Notebook execution. If the default identity used is your user, then your workspace identity must be enforced at a different layer.

Please upvote if this fix your issue.