Forum Discussion
Cannot use Managed Private Endpoints / secrets as Workspace Member in Fabric
Hi,
I’m blocked trying to use secrets with managed private endpoints from a Fabric notebook.
I’m a Member in the workspace (not Admin).
My manager is a Workspace Admin.
He created and successfully activated a Managed private endpoint for the key vault and can use the secret from his side.
In my view of the same workspace, under Workspace settings > Network security > Managed private endpoints, there are no endpoints listed – I can’t see or use the endpoint that he created.
When I try to access the secret from a notebook using:
I get this error:
An error occurred while calling z:mssparkutils.credentials.getSecret. : java.io.IOException: 403 {"error":{"code":"Forbidden","message":"Public network access is disabled and request is not from a trusted service nor via an approved private link."
So right now it behaves like this:
Member user – cannot see, set, or use private endpoints
Admin user – can see, set, and use private endpoints
This means I effectively can’t do my work, because our key vault only allows access via private endpoint and I need to use these secrets from notebooks.
From my perspective, once a workspace Admin has created and approved a managed private endpoint for the workspace, Members should at least be able to use it, even if they can’t create or manage endpoints themselves.
Is this:
Expected behavior / a missing documented permission?
A bug in how Managed private endpoints are scoped to users/roles?
Something that requires an additional role or setting that we’re overlooking?
Docs I’m following:
https://learn.microsoft.com/en-us/fabric/security/security-managed-private-endpoints-create
Any guidance or clarification on the intended behavior (and how I, as a Member, can use secrets via these private endpoints) would be appreciated.
mara5572 in a attempt to help, I check this using copilot, usually is quite close to be able to analyze the latest on Microsoft Fabric... what i did was to feed your question and this is what I've got:
Expected Behavior
- Managed Private Endpoints (MPE) in Fabric are workspace-scoped and visible only to Admins in the workspace settings UI.
- Members cannot view, create, or manage MPEs. This is by design for security and governance.
- However, using the endpoint (e.g., retrieving secrets via mssparkutils.credentials.getSecret) should work if:
- The workspace’s managed identity or your user identity has Key Vault permissions (Get/List).
- The notebook runtime supports private link routing.
- If you get a 403 Forbidden error, it means:
- The request is not routed through the approved private endpoint (because your session lacks the binding).
- Or your identity does not have the required RBAC roles on the Key Vault.
Why You Can’t See or Use It
- The UI limitation (Members not seeing MPEs) is documented but confusing. It does not mean you can’t use them—it means you can’t manage them.
- The actual blocker is that Fabric currently uses notebook owner identity for secret retrieval (not the workspace identity), and Members’ requests fail if:
- Public network access is disabled on Key Vault.
- Your identity is not authorized via private endpoint routing
What’s Needed
Permissions:
- Your Azure AD account needs:
- Key Vault Secrets User (for secret retrieval).
- Key Vault Reader (for vault discovery).
- The Fabric workspace managed identity also needs Get/List permissions on secrets. [community....rosoft.com]
- Your Azure AD account needs:
Private Endpoint Routing:
- Currently, only Admin-created endpoints are active, but routing is tied to the workspace identity.
- If workspace identity is not supported for notebooks (as of now), your user identity must have access.
Is This a Bug or Missing Feature?
- It’s expected behavior under current design:
- Members can’t manage MPEs.
- Secret access depends on identity and RBAC, not just endpoint existence.
- Microsoft roadmap suggests workspace identity support for notebooks is coming, which will fix this gap
Workarounds
- Ask your Admin to:
- Grant your user Key Vault RBAC roles.
- Confirm the workspace identity has permissions (future-proof).
- If possible, temporarily enable public network access on Key Vault for testing (not recommended for production).
- Use service principal credentials in the notebook as a fallback (less secure).
Hope this help and if so, Kudos to copilot for the answer!!!
3 Replies
- svenchio
Super User
mara5572 in a attempt to help, I check this using copilot, usually is quite close to be able to analyze the latest on Microsoft Fabric... what i did was to feed your question and this is what I've got:
Expected Behavior
- Managed Private Endpoints (MPE) in Fabric are workspace-scoped and visible only to Admins in the workspace settings UI.
- Members cannot view, create, or manage MPEs. This is by design for security and governance.
- However, using the endpoint (e.g., retrieving secrets via mssparkutils.credentials.getSecret) should work if:
- The workspace’s managed identity or your user identity has Key Vault permissions (Get/List).
- The notebook runtime supports private link routing.
- If you get a 403 Forbidden error, it means:
- The request is not routed through the approved private endpoint (because your session lacks the binding).
- Or your identity does not have the required RBAC roles on the Key Vault.
Why You Can’t See or Use It
- The UI limitation (Members not seeing MPEs) is documented but confusing. It does not mean you can’t use them—it means you can’t manage them.
- The actual blocker is that Fabric currently uses notebook owner identity for secret retrieval (not the workspace identity), and Members’ requests fail if:
- Public network access is disabled on Key Vault.
- Your identity is not authorized via private endpoint routing
What’s Needed
Permissions:
- Your Azure AD account needs:
- Key Vault Secrets User (for secret retrieval).
- Key Vault Reader (for vault discovery).
- The Fabric workspace managed identity also needs Get/List permissions on secrets. [community....rosoft.com]
- Your Azure AD account needs:
Private Endpoint Routing:
- Currently, only Admin-created endpoints are active, but routing is tied to the workspace identity.
- If workspace identity is not supported for notebooks (as of now), your user identity must have access.
Is This a Bug or Missing Feature?
- It’s expected behavior under current design:
- Members can’t manage MPEs.
- Secret access depends on identity and RBAC, not just endpoint existence.
- Microsoft roadmap suggests workspace identity support for notebooks is coming, which will fix this gap
Workarounds
- Ask your Admin to:
- Grant your user Key Vault RBAC roles.
- Confirm the workspace identity has permissions (future-proof).
- If possible, temporarily enable public network access on Key Vault for testing (not recommended for production).
- Use service principal credentials in the notebook as a fallback (less secure).
Hope this help and if so, Kudos to copilot for the answer!!!
v-prasareCommunity Support
Hi mara5572 ,
We would like to confirm if our community members answer resolves your query or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are happy to help you.
Thank you for your patience and look forward to hearing from you.
Best Regards,
Prashanth Are
MS Fabric community support- v-prasare
Hi mara5572,
We would like to confirm if our community members answer resolves your query or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are happy to help you.
Thank you for your patience and look forward to hearing from you.
Best Regards,
Prashanth Are
MS Fabric community support