Forum Discussion

Srisakthi's avatar
Srisakthi
Super User
1 year ago
Solved

Azure Key Vault Connection

Hi Everyone,   There is an Azure Key Vault support introduced for connections in Fabric with Authentication Method as OAuth. I have couple of questions 1. Is there anything in roadmap with Service...
admin
security
  • v-dineshya's avatar
    v-dineshya
    1 year ago

    Hi Srisakthi ,

    You can create and manage Key Vault connections in the Data -> Connections tab.
    Direct usage of those Key Vault connections in Lakehouse or Notebook environment is not natively exposed yet.

     

    I suggest submitting your detailed feedback and ideas through Microsoft's official feedback channels, such as Microsoft Fabric Ideas. Feedback submitted through these channels is frequently reviewed by the product teams and can contribute to meaningful improvements.
    Fabric Ideas - Microsoft Fabric Community


    If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

     

    Thank you

     

burakkaragoz's avatar
burakkaragoz
Super User
1 year ago

Hi Srisakthi ,

 

Azure Key Vault integration in Fabric is a powerful feature, and it's good to see more users exploring secure credential management. Let me address both of your points:

1️⃣ Support for Service Principal or Workspace Identity Authentication

As of now, Azure Key Vault connections in Fabric support OAuth 2.0 with user identity, but Service Principal and Workspace Managed Identity are not yet generally available for this use case.

However, based on recent roadmap updates and community discussions, support for Service Principal authentication is planned for future releases. This will be especially useful for automated workloads and CI/CD pipelines where user-based OAuth is not ideal.

In the meantime, if you need to automate access securely:

  • Consider using Azure Managed Identity in combination with Azure Synapse or Azure Data Factory, which can then feed into Fabric.
  • Alternatively, store secrets in Key Vault and retrieve them manually in notebooks using Azure SDKs (see below).

2️⃣ Using Azure Key Vault in Fabric Notebooks

Currently, there is no direct built-in method to reference a Fabric Key Vault connection inside a notebook. However, you can access secrets from Azure Key Vault using Python with the azure-identity and azure-keyvault-secrets libraries.

Here’s a sample code snippet:

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

# Replace with your Key Vault URL
key_vault_url = "https://<your-keyvault-name>.vault.azure.net/"

# Authenticate using DefaultAzureCredential (supports Managed Identity, CLI login, etc.)
credential = DefaultAzureCredential()
client = SecretClient(vault_url=key_vault_url, credential=credential)

# Retrieve a secret
secret_name = "my-secret"
retrieved_secret = client.get_secret(secret_name)

print("Secret Value:", retrieved_secret.value)

🔐 Note: This requires that your Fabric workspace or user identity has access to the Key Vault via Azure RBAC or access policies.

✅ Summary

  • Service Principal support is not yet available but is on the roadmap.
  • Notebook access to Key Vault is possible using Azure SDKs, though not yet integrated with Fabric’s connection UI.
  • Keep an eye on the Microsoft Fabric roadmap for updates on authentication enhancements.

Let me know if you’d like a full notebook example or help setting up the Key Vault permissions!

  • Srisakthi's avatar
    Srisakthi
    Super User
    1 year ago

    Hi burakkaragoz ,

    If Service Principal approach is in roadmap, then we are good.

     

    Azure Managed Identity:

    Using Azure Managed Identity and ADF is not straight forward one. 

    Python:

    This is not utilising Fabric Notebook.

     

    Here is the notebook approach if you want to utilise for

    Notebook:

    from azure.identity import ClientSecretCredential
    from azure.keyvault.secrets import SecretClient
    import ast


    tenant_id = 'your tenant id'
    client_id = 'client id'
    client_secret ='client secret'

    credential = ClientSecretCredential(tenant_id, client_id, client_secret)
    vault_url = f"https://{keyvault_name}.vault.azure.net/"

    secret_client = SecretClient(vault_url=vault_url, credential=credential)
    secret = secret_client.get_secret(sp_secret_name)
    secret_res = ast.literal_eval(secret.value)
     
    Regards,
    Srisakthi
    • burakkaragoz's avatar
      burakkaragoz
      Super User
      1 year ago

      Hi Srisakthi ,

       

      Yep, you can totally use Azure Key Vault secrets inside a Fabric Notebook. Here’s a quick way to do it using mssparkutils:

      # Replace with your actual Key Vault URL and secret name
secret_value = mssparkutils.credentials.getSecret(
    'https://<your-keyvault-name>.vault.azure.net/',
    'your-secret-name'
)
print(secret_value)

      This works as long as your workspace has access to the Key Vault and the connection is already set up in Fabric. No need to manually handle tokens or credentials—Fabric handles that behind the scenes.

      • yashaswi_raj's avatar
        yashaswi_raj
        Helper I
        1 year ago

        Hi burakkaragoz , no above solution not works if workspace has access to key vault , rather user session authentication is used here