Forum Discussion
Azure Key Vault References
Hi onerbreno
If your Fabric notebook isn't fetching secrets with mssparkutils.credentials.getSecret(), here are a few troubleshooting stesps to look out for:
- Make sure your Fabric workspace's managed identity has both the Key Vault Reader and Key Vault Secrets User roles assigned in Azure Key Vault's "Access Control (IAM)".
- Verify the Key Vault name and secret name in your code — they are case-sensitive. Even minor typos can cause silent failures.
- Check that the secret is active — not disabled or expired.
- If your Key Vault uses private endpoints or has public access fully disabled, Fabric won’t be able to reach it. Fabric currently doesn’t support connecting to Key Vaults through private endpoints.
- This code will only work inside a Fabric notebook — it won’t function in an external IDE or local script.
- To confirm which identity your notebook is using to call the Key Vault, run:
from notebookutils import mssparkutils
print(mssparkutils.credentials.getIdentityName()
Let me know if you need help checking any of these or interpreting what you find!
Note:For refrence check the below link for supported connectors and authentication types.
Azure Key Vault Reference overview (Preview) - Microsoft Fabric | Microsoft Learn
FYIIf the above information is helpful, please give us Kudos and mark the response as Accepted as solution.
Best Regards,
Community Support Team _ C Srikanth.
Thanks for sharing your experience—this is a common stumbling block! Let’s go through a checklist and some troubleshooting steps to get mssparkutils working with Azure Key Vault in Fabric notebooks:
Role Assignment Propagation:
- After assigning the “Key Vault Secrets User” role, it can take several minutes (sometimes up to an hour) for the permission to propagate across Azure AD and Fabric. If you assigned the role very recently, try waiting a bit and then re-running your notebook.
Scope of Role Assignment:
- Double-check that the role is assigned to the correct security principal (e.g., the workspace-managed identity, not your personal account), and that it’s assigned at the right scope (i.e., to the Key Vault resource, not just at a resource group or subscription level).
Key Vault Firewall/Networking:
- Ensure your Key Vault’s firewall/networking settings allow access from Fabric. If “Public access from selected networks” is enabled, make sure the Fabric service’s IP or VNet is permitted.
Secret Name and Case Sensitivity:
- Secret names in Azure Key Vault are case-sensitive. Make sure the secret name in your code exactly matches what’s in the Key Vault, with no extra spaces.
Notebook Identity:
- In Fabric, notebooks usually run under the workspace’s managed identity. Make sure this identity is the one with “Key Vault Secrets User” on the vault.
Sample Working Code:
- Here’s a typical working snippet (replace placeholders with your actual values):Python
import mssparkutils secret = mssparkutils.credentials.getSecret("YourKeyVaultName", "YourSecretName") print(secret)
- If this throws an error, please share the exact error message—sometimes the error text gives a clue (e.g., “Forbidden”, “NotFound”, or “Network” errors).
- Here’s a typical working snippet (replace placeholders with your actual values):
Testing from Azure Portal:
- As a sanity check, try accessing the secret using the “Test access” feature in the Azure Key Vault portal, logged in as the same identity as your notebook uses.
If after all this you’re still getting blocked, could you paste the exact error message you receive? That’ll help narrow down whether it’s a permissions, network, or configuration issue.
Let me know how it goes—I’m happy to help you troubleshoot further!
If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.
Hello, burakkaragoz! Thank you very much for your reply.
Unfortunately, I still haven't been successful.
I granted the "Key Vault Secrets User" role to the Workspace Identity, and to be sure, I also assigned the "Admin" permission to the Fabric workspace.
To test, I’m asking a user without permissions on the Azure Key Vault to run the notebook in the configured workspace. This user has the "Contributor" role in the workspace.
Below is the error returned:
403 Forbidden
{
"error": {
"code": "Forbidden",
"message": "Caller is not authorized to perform action on resource.
If role assignments, deny assignments or role definitions were changed recently, please observe propagation time.
Caller:
appid={user_entra_id}
oid={id}
iss=https://sts.windows.net/c91d481c-40b4-4ff9-8f2e-a00df534d8b7/
Action:
'Microsoft.KeyVault/vaults/secrets/getSecret/action'
Resource:
'/subscriptions/{subscription_id}/resourcegroups/rg-demos/providers/microsoft.keyvault/vaults/akv-dtx-demo/secrets/teste'
Assignment: (not found)
DenyAssignmentId: null
DecisionReason: null
Vault: akv-dtx-demo; location=eastus2",
"innererror": {
"code": "ForbiddenByRbac"
}
}
}
In the error body, under "Caller", I noticed that the "oid" field corresponds to the Entra ID of the user running the notebook, which indicates that this identity is being used to authenticate with the Key Vault, not the Workspace Identity.
I wasn't able to identify which resource the provided "appid" refers to.
Additional notes:
Key Vault firewall/network settings: configured to Allow public access from all networks
Secret name: confirmed to be correct
Role propagation: I’ll wait a few hours to see if the issue persists
If you have any further suggestions or if I missed something, I’d really appreciate your input.