Forum Discussion

Srisakthi's avatar
Srisakthi
Super User
1 year ago
Solved

Azure Key Vault Connection

Hi Everyone,   There is an Azure Key Vault support introduced for connections in Fabric with Authentication Method as OAuth. I have couple of questions 1. Is there anything in roadmap with Service...
admin
security
  • v-dineshya's avatar
    v-dineshya
    1 year ago

    Hi Srisakthi ,

    You can create and manage Key Vault connections in the Data -> Connections tab.
    Direct usage of those Key Vault connections in Lakehouse or Notebook environment is not natively exposed yet.

     

    I suggest submitting your detailed feedback and ideas through Microsoft's official feedback channels, such as Microsoft Fabric Ideas. Feedback submitted through these channels is frequently reviewed by the product teams and can contribute to meaningful improvements.
    Fabric Ideas - Microsoft Fabric Community


    If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

     

    Thank you

     

burakkaragoz's avatar
burakkaragoz
Super User
1 year ago

Hi Srisakthi ,

 

Thanks for clarifying – now I get what you're aiming for.

Currently, Fabric Notebooks don’t natively expose the Key Vault Connections created in the UI (like they do for pipelines or dataflows). But here are a couple of workarounds you can try:

Option 1: Use Azure Identity + SDK

If your notebook is running in a managed identity context (like Fabric runtime), you can use the Azure SDK to access secrets directly:

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

key_vault_url = "https://<your-keyvault-name>.vault.azure.net/"
credential = DefaultAzureCredential()
client = SecretClient(vault_url=key_vault_url, credential=credential)

secret = client.get_secret("your-secret-name")
print(secret.value)

Make sure the Fabric workspace or runtime has access to the Key Vault via RBAC or access policies.

Option 2: Store secrets in a config table

If direct access isn’t working, you can store secrets (or connection strings) in a secured Lakehouse table and read them at runtime. Not ideal, but works for controlled environments.

Let me know if you want help setting up the identity permissions or testing the SDK approach. Happy to walk through it with you.

hgupta13's avatar
hgupta13
Frequent Visitor
1 year ago

Hi burakkaragoz,

I was trying the following solutions


1. Markutils: But this get the secret under the user who is running the notebook. So as  notebook user I need read,get access to the keyvault. (I would like to avoid this method as multiple devs are working)

 

2. I was trying the SDK where I am using. I did added the worksapce name in the access policy of my keyvault. But Still I am not able to access it. Can you let me know what I can do in this scenario?

  • yashaswi_raj's avatar
    yashaswi_raj
    Helper I
    11 months ago

    Hi hgupta13 , yes what you are trying will not work .
    DefaultAzureCredential() is also not supported in Fabric notebook to fetch secret.

    what i did was called the notebook directly from ADF using web activity with which the notebook took the adf managed identity's autnetication .

     

    You can Check if you also have similar scenario