Users can access key vault secrets using notebookutils.credentials.getSecret. This is based purely on the user's access (or object owner's access, if the notebook is being run in a pipeline). In larger organizations, managing access at the individual level is not scalable. It would be preferable to associate key vault privileges with a service principal so that connections keep running if a particular user leaves the business.
The workspace identity is an obvious candidate to be given key vault permissions. While this is technically possible - we can add key vault privileges to a workspace identity's associated entra ID app service principal - the service principal's credentials are not used by the notebookutils.credentials.getSecret method. (At least based on my current understanding - this seems to be a known limitation if you read related posts in the Fabric user forums as of August 2025).
Please make it possible to access key vault secrets using workspace identities.
makromer
on:
Fabric Data Pipeline should be able to execute dbt...
on:
Customers should ereceive notifications for all th...
miguel
on:
Recent Data and Recent Connections
on:
Need more details on Average utilization% in Capac...
on:
Access Variable Library in Semantic Models