Forum Discussion

willparker1's avatar
willparker1
New Member
1 year ago
Solved

Azure Key Vault References

Hi   Anyone tried using the new Azure Key Vault references feature?   I think it was part of the Q1 2025 feature drop but looks only partially implemented to me.   We now have a new tab under "...
admin
security
  • v-csrikanth's avatar
    v-csrikanth
    1 year ago

    Hi onerbreno 

    If your Fabric notebook isn't fetching secrets with mssparkutils.credentials.getSecret(), here are a few troubleshooting stesps to look out for:

    • Make sure your Fabric workspace's managed identity has both the Key Vault Reader and Key Vault Secrets User roles assigned in Azure Key Vault's "Access Control (IAM)".
    • Verify the Key Vault name and secret name in your code — they are case-sensitive. Even minor typos can cause silent failures.
    • Check that the secret is active — not disabled or expired.
    • If your Key Vault uses private endpoints or has public access fully disabled, Fabric won’t be able to reach it. Fabric currently doesn’t support connecting to Key Vaults through private endpoints.
    • This code will only work inside a Fabric notebook — it won’t function in an external IDE or local script.
    • To confirm which identity your notebook is using to call the Key Vault, run:
              from notebookutils import mssparkutils
              print(mssparkutils.credentials.getIdentityName()
      Let me know if you need help checking any of these or interpreting what you find!

    Note:For refrence check the below link for supported connectors and authentication types.
    Azure Key Vault Reference overview (Preview) - Microsoft Fabric | Microsoft Learn

    FYI 

    If the above information is helpful, please give us Kudos and mark the response as Accepted as solution.
    Best Regards,
    Community Support Team _ C Srikanth.

v-csrikanth's avatar
v-csrikanth
Community Support
1 year ago

Hi willparker1 
Please check the below points that might resolve your issue:

  • Azure Key Vault references currently work directly only with Blob Storage connections in Fabric; other connectors like Power BI or ArcGIS don’t support this yet.
  • In the “Manage Connections and Gateways” section, you can define a Key Vault reference, but only compatible connectors will expose it during credential entry.
  • For other use cases, use Fabric notebooks to securely fetch secrets with this code:

from notebookutils import mssparkutils

secret = mssparkutils.credentials.getSecret("YourKeyVaultName", "YourSecretName")

  • Ensure the Fabric workspace managed identity has the "Key Vault Secrets User" role assigned to the Key Vault.
  • After fetching the secret in the notebook, you can use it to connect to APIs, databases, or secured storage, and then store the processed data in a Lakehouse or Warehouse.
  • Connect Power BI, ArcGIS, or other services to that processed data rather than trying to inject secrets directly into unsupported connectors.
  • This method maintains security while enabling integration across Fabric workloads.
  • Azure Key Vault support in Fabric is still evolving—wider connector support is expected in future updates, so keep an eye on the roadmap.

Best Regards,
Cheri Srikanth 

  • onerbreno's avatar
    onerbreno
    Frequent Visitor
    1 year ago

    Hi, v-csrikanth!

    I tested these steps but wasn’t successful. Could you help me understand what might be missing?

    • For other use cases, use Fabric notebooks to securely fetch secrets with this code:

    from notebookutils import mssparkutils

    secret = mssparkutils.credentials.getSecret("YourKeyVaultName", "YourSecretName")

    • Ensure the Fabric workspace managed identity has the "Key Vault Secrets User" role assigned to the Key Vault.