Forum Discussion

Srisakthi's avatar
Srisakthi
Super User
1 year ago
Solved

Azure Key Vault Connection

Hi Everyone,

 

There is an Azure Key Vault support introduced for connections in Fabric with Authentication Method as OAuth. I have couple of questions

1. Is there anything in roadmap with Service Principal or Workspace Identity as Authentication Method?

2. How can I refer azure key vault connection in notebooks is there any sample?

 

Regards,

Srisakthi

 

admin
security
  • v-dineshya's avatar
    v-dineshya
    1 year ago

    Hi Srisakthi ,

    You can create and manage Key Vault connections in the Data -> Connections tab.
    Direct usage of those Key Vault connections in Lakehouse or Notebook environment is not natively exposed yet.

     

    I suggest submitting your detailed feedback and ideas through Microsoft's official feedback channels, such as Microsoft Fabric Ideas. Feedback submitted through these channels is frequently reviewed by the product teams and can contribute to meaningful improvements.
    Fabric Ideas - Microsoft Fabric Community


    If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

     

    Thank you

     

17 Replies

  • yvaubourg's avatar
    yvaubourg
    Resolver I
    1 year ago

    Hi Srisakthi,

    1. I don't see why at least Service Principal connection won't be added in the Future. As for "Workspace Identity", it could be weird to be able to do it as the connections are usable in your entire Fabric tenant.

    2. The documentation state for Key Vault reference are only usable for connection. Before this feature, you could already connect to Azure Key Vault in Notebook. Here is a end to end tutorial to do it

     

    Regards,

    Yohann

  • burakkaragoz's avatar
    burakkaragoz
    Super User
    1 year ago

    Hi Srisakthi ,

     

    Azure Key Vault integration in Fabric is a powerful feature, and it's good to see more users exploring secure credential management. Let me address both of your points:

    1️⃣ Support for Service Principal or Workspace Identity Authentication

    As of now, Azure Key Vault connections in Fabric support OAuth 2.0 with user identity, but Service Principal and Workspace Managed Identity are not yet generally available for this use case.

    However, based on recent roadmap updates and community discussions, support for Service Principal authentication is planned for future releases. This will be especially useful for automated workloads and CI/CD pipelines where user-based OAuth is not ideal.

    In the meantime, if you need to automate access securely:

    • Consider using Azure Managed Identity in combination with Azure Synapse or Azure Data Factory, which can then feed into Fabric.
    • Alternatively, store secrets in Key Vault and retrieve them manually in notebooks using Azure SDKs (see below).

    2️⃣ Using Azure Key Vault in Fabric Notebooks

    Currently, there is no direct built-in method to reference a Fabric Key Vault connection inside a notebook. However, you can access secrets from Azure Key Vault using Python with the azure-identity and azure-keyvault-secrets libraries.

    Here’s a sample code snippet:

    from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

# Replace with your Key Vault URL
key_vault_url = "https://<your-keyvault-name>.vault.azure.net/"

# Authenticate using DefaultAzureCredential (supports Managed Identity, CLI login, etc.)
credential = DefaultAzureCredential()
client = SecretClient(vault_url=key_vault_url, credential=credential)

# Retrieve a secret
secret_name = "my-secret"
retrieved_secret = client.get_secret(secret_name)

print("Secret Value:", retrieved_secret.value)

    🔐 Note: This requires that your Fabric workspace or user identity has access to the Key Vault via Azure RBAC or access policies.

    ✅ Summary

    • Service Principal support is not yet available but is on the roadmap.
    • Notebook access to Key Vault is possible using Azure SDKs, though not yet integrated with Fabric’s connection UI.
    • Keep an eye on the Microsoft Fabric roadmap for updates on authentication enhancements.

    Let me know if you’d like a full notebook example or help setting up the Key Vault permissions!

    • Srisakthi's avatar
      Srisakthi
      Super User
      1 year ago

      Hi burakkaragoz ,

      If Service Principal approach is in roadmap, then we are good.

       

      Azure Managed Identity:

      Using Azure Managed Identity and ADF is not straight forward one. 

      Python:

      This is not utilising Fabric Notebook.

       

      Here is the notebook approach if you want to utilise for

      Notebook:

      from azure.identity import ClientSecretCredential
      from azure.keyvault.secrets import SecretClient
      import ast


      tenant_id = 'your tenant id'
      client_id = 'client id'
      client_secret ='client secret'

      credential = ClientSecretCredential(tenant_id, client_id, client_secret)
      vault_url = f"https://{keyvault_name}.vault.azure.net/"

      secret_client = SecretClient(vault_url=vault_url, credential=credential)
      secret = secret_client.get_secret(sp_secret_name)
      secret_res = ast.literal_eval(secret.value)
       
      Regards,
      Srisakthi
      • burakkaragoz's avatar
        burakkaragoz
        Super User
        1 year ago

        Hi Srisakthi ,

         

        Yep, you can totally use Azure Key Vault secrets inside a Fabric Notebook. Here’s a quick way to do it using mssparkutils:

        # Replace with your actual Key Vault URL and secret name
secret_value = mssparkutils.credentials.getSecret(
    'https://<your-keyvault-name>.vault.azure.net/',
    'your-secret-name'
)
print(secret_value)

        This works as long as your workspace has access to the Key Vault and the connection is already set up in Fabric. No need to manually handle tokens or credentials—Fabric handles that behind the scenes.

  • v-dineshya's avatar
    v-dineshya
    Community Support
    1 year ago

    Hi Srisakthi ,

    Thank you for reaching out to the Microsoft Community Forum.

     

    1. Roadmap for Service Principal or Workspace Identity as Authentication Methods

    Azure Key Vault connections in Microsoft Fabric support OAuth authentication. While there is no explicit documentation detailing the roadmap for Service Principal or Workspace Identity authentication methods for Azure Key Vault connections, Microsoft is actively enhancing authentication capabilities within Fabric.

    Workspace Identity a managed service principal associated with a Fabric workspace is available and can be used for authentication with certain data sources, such as Azure Data Lake Storage Gen2. This feature allows Fabric items like OneLake shortcuts, data pipelines, and semantic models to authenticate securely without managing credentials manually.

    While Workspace Identity support for Azure Key Vault connections is not explicitly mentioned, the ongoing enhancements suggest that broader authentication method support may be introduced in the future.

    2. Referencing Azure Key Vault Connections in Notebooks

    To access Azure Key Vault secrets within Fabric notebooks, you can use the mssparkutils library.

    sample code snippet:

    # Replace with your Key Vault URL and secret name
    secret_value = mssparkutils.credentials.getSecret('https://<your-keyvault-name>.vault.azure.net/', 'your-secret-name')
    print(secret_value)

     

    Please refer community threads and Microsoft articles and blogs.

    Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn

    Authenticate to Fabric data connections using Azure Key Vault stored secrets (Preview) | Microsoft Fabric Blog | Microsoft Fabric

    Solved: Access Key-vault in notebooks - Microsoft Fabric Community

    Authenticate to Azure Key Vault | Microsoft Learn

    Workspace identity - Microsoft Fabric | Microsoft Learn

     

    If my response has resolved your query, please mark it as the "Accepted Solution" to assist others. Additionally, a "Kudos" would be appreciated if you found my response helpful.

     

    Thank you

    • v-dineshya's avatar
      v-dineshya
      Community Support
      1 year ago

      Hi Srisakthi ,

      If my response has resolved your query, please mark it as the "Accepted Solution" to assist others. Additionally, a "Kudos" would be appreciated if you found my response helpful.

       

      Thank you

      • v-dineshya's avatar
        v-dineshya
        Community Support
        1 year ago

        Hi @Srisakthi ,

        If my response has resolved your query, please mark it as the "Accepted Solution" to assist others. Additionally, a "Kudos" would be appreciated if you found my response helpful.

         

        Thank you

  • burakkaragoz's avatar
    burakkaragoz
    Super User
    1 year ago

    Hi Srisakthi ,

     

    Just checking in – did the steps I shared help resolve the issue?

    ✅ If it’s working now, feel free to mark the response as the Accepted Solution. This helps others who face the same issue find the fix faster.
    ✨ And of course, a little Kudos would be much appreciated!

    If you're still running into trouble, let me know what you've tried so far and I’ll help you dig deeper. We’ll get it sorted!

  • Srisakthi's avatar
    Srisakthi
    Super User
    1 year ago

    Hi burakkaragoz ,

     

    Referencing key vault in notebook directly I have explored few months back itself. What I was looking for is using Key vault conenction that we create in MS Fabric to be referred in notebook

     

    Regards,

    Srisakthi

    • burakkaragoz's avatar
      burakkaragoz
      Super User
      1 year ago

      Hi Srisakthi ,

       

      Thanks for clarifying – now I get what you're aiming for.

      Currently, Fabric Notebooks don’t natively expose the Key Vault Connections created in the UI (like they do for pipelines or dataflows). But here are a couple of workarounds you can try:

      Option 1: Use Azure Identity + SDK

      If your notebook is running in a managed identity context (like Fabric runtime), you can use the Azure SDK to access secrets directly:

      from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

key_vault_url = "https://<your-keyvault-name>.vault.azure.net/"
credential = DefaultAzureCredential()
client = SecretClient(vault_url=key_vault_url, credential=credential)

secret = client.get_secret("your-secret-name")
print(secret.value)

      Make sure the Fabric workspace or runtime has access to the Key Vault via RBAC or access policies.

      Option 2: Store secrets in a config table

      If direct access isn’t working, you can store secrets (or connection strings) in a secured Lakehouse table and read them at runtime. Not ideal, but works for controlled environments.

      Let me know if you want help setting up the identity permissions or testing the SDK approach. Happy to walk through it with you.

      • hgupta13's avatar
        hgupta13
        Frequent Visitor
        1 year ago

        Hi burakkaragoz,

        I was trying the following solutions


        1. Markutils: But this get the secret under the user who is running the notebook. So as  notebook user I need read,get access to the keyvault. (I would like to avoid this method as multiple devs are working)

         

        2. I was trying the SDK where I am using. I did added the worksapce name in the access policy of my keyvault. But Still I am not able to access it. Can you let me know what I can do in this scenario?