Azure Keyvault integration to Fabric Data Factory

[girishtharwani2]

I am looking for a way to integrate Azure Key Vault into Fabric Data Factory pipelines. Unfortunately, I haven't had any success so far. Any suggestions on how to achieve this integration?

Thanks,

Girish

[NandanHegde · Accepted solution]

When you state integration of Key vault in fabric data pipelines, can you please state whether it is in the ocnnections or within the pipeline?

Unfortunately, KV integration within connections is not available as of today.

Within pipelines, you can use web activity and KV rest API to get the secert values

[v-pbandela-msft · Accepted solution]

Hi @girishtharwani2 ,

I wanted to follow up since we haven't heard back from you regarding our last response. We hope your issue has been resolved.
If the community member's answer your query, please mark it as "Accept as Solution" and select "Yes" if it was helpful.
If you need any further assistance, feel free to reach out.

Thank you,
Pavan.

[v-pbandela-msft]

Hi @girishtharwani2 

Thanks for reaching out in Microsoft Community Forum

Key Vault integration with Fabric data factory is not available but within pipelines you can use webactivity and key vault REST API to get secret values

To retrieve secret values from Azure Key Vault within a Fabric Data Factory pipeline using Web Activity and Key Vault REST API, follow these steps:

Step 1: Grant Permissions to Access Key Vault

Go to the Azure portal and navigate to your Azure Key Vault.

Assign appropriate permissions

step 2; If using Managed Identity, ensure the Fabric Data Factory's Managed Identity has Get access on secrets.

If using Service Principal, grant similar permissions to the Service Principal.

step 3; Obtain the Key Vault REST API URL

The base URL for Key Vault REST API is: https://<YourKeyVaultName>.vault.azure.net/

To access a specific secret, append the secret name: https://<YourKeyVaultName>.vault.azure.net/secrets/<SecretName>?api-version=7.3

step 4; Configure Web Activity in Fabric Data Factory

URL: Enter the Key Vault secret URL (https://<YourKeyVaultName>.vault.azure.net/secrets/<SecretName>?api-version=7.3).

Method: Set to GET.

Authentication:

For Managed Identity:

Select the Managed Identity option.

Ensure the Managed Identity has access to the Key Vault.

For Service Principal:

Obtain an Access Token from Azure AD and pass it in the Authorization header.

Add a header with the following key-value pair: Authorization: Bearer <AccessToken>

Step 5: Get an Access Token (If Using Service Principal)

Add a separate Web Activity to retrieve an Azure AD token using the OAuth 2.0 token endpoint:

URL: https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/token

Method: POST

Body:

{

  "grant_type": "client_credentials",

  "client_id": "<ServicePrincipalClientID>",

  "client_secret": "<ServicePrincipalSecret>",

  "scope": "https://vault.azure.net/.default"

}

Headers:

Content-Type: application/x-www-form-urlencoded

5.Capture the token response in the output of this activity.

6. Link Access Token to Key Vault Web Activity

In the Key Vault Web Activity, use the output of the token retrieval activity for the Authorization header:

Use dynamic content to reference the token: @concat('Bearer ', activity('GetTokenActivityName').output.access_token)

7. Use Retrieved Secret Value

The Key Vault API returns the secret value in the value property of the JSON response.

Pass this output dynamically to subsequent pipeline activities: @activity('GetSecretActivityName').output.value

If you found this post helpful, please consider marking it as "Accept as Solution" to help other members find it more easily.

 Thanks,

 Pavan.

[ToddChitt]

Hello @v-pbandela-msft 

I came across this post while trying to get a Fabric Pipeline Web activity to connect to an Azure Key Vault and retireve a Secret Value. I am having trouble:

You state: "step 2; If using Managed Identity, ensure the Fabric Data Factory's Managed Identity has Get access on secrets.

If using Service Principal, grant similar permissions to the Service Principal."

Fabric Data Factory's Managed Identity? Where is that? Is that the Workspace Identity from Workspace Settings? 

For step 4, you state that for Managed Identity...

But that is not an option in Web Activity's Connection Properties. For Authentication Kind, I see: Anonymous, Basic, and Service principle.

What am I missing?

[GarryH]

What do you do if it is ServicePrincipalSecret that you are trying to retrieve from the key vault?

[NandanHegde · Accepted solution]

When you state integration of Key vault in fabric data pipelines, can you please state whether it is in the ocnnections or within the pipeline?

Unfortunately, KV integration within connections is not available as of today.

Within pipelines, you can use web activity and KV rest API to get the secert values