Join us at FabCon Atlanta from March 16 - 20, 2026, for the ultimate Fabric, Power BI, AI and SQL community-led event. Save $200 with code FABCOMM.
Register now!Special holiday offer! You and a friend can attend FabCon with a BOGO code. Supplies are limited. Register now.
I am trying to retrieve secrets from Azure Key Vault in a Microsoft Fabric Notebook using:
However, I keep getting this error:
Solved! Go to Solution.
Hi @Ms_Techzill,
Iam not sure about the error message. But check out this nice video from Patrick. With this it worked for me.
Keep your secrets SAFE in Microsoft Fabric and Azure Key Vault
Also good to know that currently the actual notebook owner need to have the Key Vault RBAC rights as delegation to workspace identity or SP is not supported.
Best regards!
Hi @Ms_Techzill , Thank you for reaching out to the Microsoft Community Forum.
@Mauro89 was right about the core issue, the notebook runs under the user who executes it and that user must have Key Vault secret-read permissions. If they don’t, getSecret() throws the Py4JJavaError you’re seeing.
Your call is also failing because mssparkutils.credentials.getSecret() expects either a properly created linked service alias or the full Key Vault URL. Most of the time the alias doesn’t resolve, so call the vault directly using its endpoint and make sure the notebook runner has a Key Vault secrets role. Once you pass the URL and the user has permissions, the secret loads cleanly.
Introduction to Microsoft Spark utilities - Azure Synapse Analytics | Microsoft Learn
Grant permission to applications to access an Azure key vault using Azure RBAC | Microsoft Learn
NotebookUtils (former MSSparkUtils) for Fabric - Microsoft Fabric | Microsoft Learn
Microsoft Spark Utilities (MSSparkUtils) for Fabric - Microsoft Fabric | Microsoft Learn
Hello @Mauro89 , thanks so much. I eventually changed it to the vault uri and it worked. Thank you
Hi @Ms_Techzill , Thank you for reaching out to the Microsoft Community Forum.
@Mauro89 was right about the core issue, the notebook runs under the user who executes it and that user must have Key Vault secret-read permissions. If they don’t, getSecret() throws the Py4JJavaError you’re seeing.
Your call is also failing because mssparkutils.credentials.getSecret() expects either a properly created linked service alias or the full Key Vault URL. Most of the time the alias doesn’t resolve, so call the vault directly using its endpoint and make sure the notebook runner has a Key Vault secrets role. Once you pass the URL and the user has permissions, the secret loads cleanly.
Introduction to Microsoft Spark utilities - Azure Synapse Analytics | Microsoft Learn
Grant permission to applications to access an Azure key vault using Azure RBAC | Microsoft Learn
NotebookUtils (former MSSparkUtils) for Fabric - Microsoft Fabric | Microsoft Learn
Microsoft Spark Utilities (MSSparkUtils) for Fabric - Microsoft Fabric | Microsoft Learn
--------------------------------------------------------------------------- Py4JJavaError Traceback (most recent call last) Cell In[49], line 14 7 from azure.keyvault.secrets import SecretClient 11 # ====== Load secrets from Azure Key Vault ====== 12 13 # Replace "kv-emailcomm" with your actual Key Vault connection name in Fabric ---> 14 CONNECTION_STRING = mssparkutils.credentials.getSecret("emailcommunicationkey", "ACS-CONNECTION-STRING") 15 SENDER = mssparkutils.credentials.getSecret("emailcommunicationkey", "SENDER-EMAIL") 19 # Initialize EmailClient File ~/cluster-env/trident_env/lib/python3.11/site-packages/notebookutils/mssparkutils/credentials.py:27, in getSecret(akvName, secret, linkedService) 25 def getSecret(akvName, secret, linkedService=''): 26 if linkedService == '': ---> 27 return creds.getSecret(akvName, secret) 28 else: 29 return creds.getSecret(akvName, secret, linkedService)
@Mauro89 , thank you for your response. I have watched the video and when I try to run the api_key from my part it shows ["redacted"] just as that of the video. However, when I included it in my code I have the below
code
Hi @Ms_Techzill,
I guess your Key Vault URI is not correct. Thats where you wrote "emailcommunicationkey", so the first parameter in the "get_secret" function.
Here acutally your "Vault URI" needs to be passed. This you can find if you open you Key Vault and go to the overview (marked in red):
Then the second parameter as being the acutal name of the secret.
This should work then as expected.
Best regards!
Hello @Mauro89 , thanks so much. I eventually changed it to the vault uri and it worked. Thank you
Hi @Ms_Techzill,
Iam not sure about the error message. But check out this nice video from Patrick. With this it worked for me.
Keep your secrets SAFE in Microsoft Fabric and Azure Key Vault
Also good to know that currently the actual notebook owner need to have the Key Vault RBAC rights as delegation to workspace identity or SP is not supported.
Best regards!