Using Key Vault secrets in Notebooks from Workspace identities

[dolphinantonym]

My Workspace has an identity that is allowed to access a Key Vault that contains secrets for accessing an API.

When I try and access the secret from Notebooks (using notebookutils.credentials.getSecret(keyVaultURL, secretName)) I keep getting 403 errors.

The error references an oid which matches my personal Entra ID, so this makes sense because I do not have personal access to view secrets in the vault.

What do I need to do to force the Notebook to use the Workspace identity rather than my own?

[dolphinantonym]

---

@youdao4 wrote:

1. 🧠 Use TokenLibrary.getAccessToken() instead:
   If notebookutils.credentials.getSecret() isn’t using the Workspace identity, it’s likely falling back to your user context. Try using this method instead:

from notebookutils import mssparkutils
token = mssparkutils.credentials.getToken("https://vault.azure.net")

---

Can you elaborate on that? You mention using getAccessToken but then the example uses getToken(). In either case, do I need to provide an argument for the name of the secret as with getSecret()?

[dolphinantonym]

The whole problem is that I can't retrieve tokens from the Key Vault, because the Notebook uses my identity - which doesn't have access to the Key Vault - rather than the Workspace identity, which does have access.

[Natalie_iTalent]

Hello @dolphinantonym,

Answers to this thread that were inaccurate were removed from the thread.

Feel free to message me if you have questions.

Best,

Natalie H.

Community Manager 

[spaceman127]

Hello @dolphinantonym ,

Currently, notebook identities are not yet supported for retrieving secrets from a key vault. Only the user identity running the notebook is currently supported for retrieving secrets.

If you want to be able to access your secrets, your executing user must have permission to access the Key Vault.
Unfortunately, this is still a limitation.

I hope that this will happen soon.

Edit: Here you can find documentation on what the workspace identity can be used for. 

https://learn.microsoft.com/en-us/fabric/security/workspace-identity-authenticate?OR=OfficeMobile

Best regards

[dolphinantonym]

@AJ1093 do you understand things differently given this comment of yours?

The default behavior in Microsoft Fabric Notebooks is to use the user identity unless explicitly configured to use the Workspace identity.

---

What is the process to "explicitly configure" a Notebook to use the Workspace identity?

[v-lgarikapat]

Hi @dolphinantonym ,

Thanks for reaching out to the Microsoft fabric community forum.

@AJ1093 

Thanks for your prompt response,

In Addition to  @AJ1093 ,

 Solved: Access Key-vault in notebooks - Microsoft Fabric Community

Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn

Azure Key Vault Reference overview (Preview) - Microsoft Fabric | Microsoft Learn

If you are still encountering any challenges, we would be happy to assist you further.

Best Regards,

Lakshmi

[dolphinantonym]

---

@v-lgarikapat wrote:

Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn

If you are still encountering any challenges, we would be happy to assist you further.

Best Regards,

Lakshmi

---

I have run through the steps here (this is what I had done before starting this thread) but I still get 403 errors because I can't figure out how to make the Notebook run using the Workspace Identity rather than my own.

Could you elaborate, please?

[v-lgarikapat]

Hi @dolphinantonym ,

Thank you for your detailed explanation. It looks like you've already followed the recommended steps, but the issue still persists.

To help resolve this further, I recommend raising a support ticket so our support team can assist you directly.
Please refer to the following link for instructions on how to create a support ticket:

How to create a Fabric and Power BI Support ticket - Power BI | Microsoft Learn

We appreciate your engagement and thank you for being an active part of the community.

Best regards,
Lakshmi

[v-lgarikapat]

Hi @dolphinantonym ,

We’d like to confirm whether your issue has been successfully resolved. If you still have any questions or need further assistance, please don’t hesitate to reach out. We’re more than happy to continue supporting you.

Best Regards,

Lakshmi

[AJ1093]

To use Workspace Managed Identity (WMI) instead of your user identity to access Azure Key Vault secrets from Notebooks in Microsoft Fabric, you need to ensure a few configuration steps are completed. Right now, your notebook is using your personal identity (your Entra ID object ID) rather than the workspace identity, which is why you're getting a 403.

Here’s how to fix it:

Grant Access to the Workspace Managed Identity in Key Vault

1. Your Key Vault needs to allow access for the workspace's identity.

2. In Azure Portal, go to your Key Vault.

3. Navigate to Access Control (IAM).

4. Add a role assignment:

a. Role: Key Vault Secrets User (or Key Vault Reader depending on access level).

b. Assign access to: Managed identity.

c. Select: Your Microsoft Fabric workspace identity.

Alternatively, if you're using access policies (not RBAC):

1. Go to Key Vault → Access policies.

2. Add an access policy:

a. Select Get secret permissions.

b. Under "Principal", select the Workspace Managed Identity.

Ensure Your Notebook Uses the Workspace Identity

The default behavior in Microsoft Fabric Notebooks is to use the user identity unless explicitly configured to use the Workspace identity.

To ensure the workspace identity is used:

• Use the correct Fabric-specific library/methods that support workspace identity. The typical notebookutils.credentials.getSecret(...) may default to your user identity.

Instead, you should use the Microsoft Fabric runtime feature that supports workspace identity by default for data access.

If notebookutils.credentials.getSecret(...) is intended to support workspace identity in Fabric, then Microsoft must have implemented it accordingly — however, if it still refers to your personal object ID (OID), then the identity used is your personal one.

Workaround:
As of now, Fabric does not allow switching identity in the middle of a Notebook execution. If the default identity used is your user, then your workspace identity must be enforced at a different layer.

Please upvote if this fix your issue.

[dolphinantonym]

---

@AJ1093 wrote:

• Use the correct Fabric-specific library/methods that support workspace identity. The typical notebookutils.credentials.getSecret(...) may default to your user identity.

Instead, you should use the Microsoft Fabric runtime feature that supports workspace identity by default for data access.

---

Which are the correct Fabric-specific libraries/methods? And which "runtime feature" supports workspace identity?