Azure Key Vault References

Hi Anyone tried using the new Azure Key Vault references feature? I think it was part of the Q1 2025 feature drop but looks only partially implemented to me. We now have a new tab under "...

admin

security

v-csrikanth
1 year ago
Hi onerbreno

If your Fabric notebook isn't fetching secrets with mssparkutils.credentials.getSecret(), here are a few troubleshooting stesps to look out for:

Make sure your Fabric workspace's managed identity has both the Key Vault Reader and Key Vault Secrets User roles assigned in Azure Key Vault's "Access Control (IAM)".

Verify the Key Vault name and secret name in your code — they are case-sensitive. Even minor typos can cause silent failures.

Check that the secret is active — not disabled or expired.

If your Key Vault uses private endpoints or has public access fully disabled, Fabric won’t be able to reach it. Fabric currently doesn’t support connecting to Key Vaults through private endpoints.

This code will only work inside a Fabric notebook — it won’t function in an external IDE or local script.

To confirm which identity your notebook is using to call the Key Vault, run:
from notebookutils import mssparkutils
print(mssparkutils.credentials.getIdentityName()
Let me know if you need help checking any of these or interpreting what you find!

Note:For refrence check the below link for supported connectors and authentication types.
Azure Key Vault Reference overview (Preview) - Microsoft Fabric | Microsoft Learn

FYI

If the above information is helpful, please give us Kudos and mark the response as Accepted as solution.
Best Regards,
Community Support Team _ C Srikanth.

burakkaragoz

Super User

1 year ago

onerbreno ,

Thanks for sharing your experience—this is a common stumbling block! Let’s go through a checklist and some troubleshooting steps to get mssparkutils working with Azure Key Vault in Fabric notebooks:

Role Assignment Propagation:
- After assigning the “Key Vault Secrets User” role, it can take several minutes (sometimes up to an hour) for the permission to propagate across Azure AD and Fabric. If you assigned the role very recently, try waiting a bit and then re-running your notebook.
Scope of Role Assignment:
- Double-check that the role is assigned to the correct security principal (e.g., the workspace-managed identity, not your personal account), and that it’s assigned at the right scope (i.e., to the Key Vault resource, not just at a resource group or subscription level).
Key Vault Firewall/Networking:
- Ensure your Key Vault’s firewall/networking settings allow access from Fabric. If “Public access from selected networks” is enabled, make sure the Fabric service’s IP or VNet is permitted.
Secret Name and Case Sensitivity:
- Secret names in Azure Key Vault are case-sensitive. Make sure the secret name in your code exactly matches what’s in the Key Vault, with no extra spaces.
Notebook Identity:
- In Fabric, notebooks usually run under the workspace’s managed identity. Make sure this identity is the one with “Key Vault Secrets User” on the vault.
Sample Working Code:
- Here’s a typical working snippet (replace placeholders with your actual values):
  Python
```
import mssparkutils
secret = mssparkutils.credentials.getSecret("YourKeyVaultName", "YourSecretName")
print(secret)
```
- If this throws an error, please share the exact error message—sometimes the error text gives a clue (e.g., “Forbidden”, “NotFound”, or “Network” errors).
Testing from Azure Portal:
- As a sanity check, try accessing the secret using the “Test access” feature in the Azure Key Vault portal, logged in as the same identity as your notebook uses.

If after all this you’re still getting blocked, could you paste the exact error message you receive? That’ll help narrow down whether it’s a permissions, network, or configuration issue.

Let me know how it goes—I’m happy to help you troubleshoot further!

If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.