Cannot use Managed Private Endpoints / secrets as Workspace Member in Fabric

mara5572  in a attempt to help, I check this using copilot, usually is quite close to be able to analyze the latest on Microsoft Fabric... what i did was to feed your question and this is what I've got: 

Expected Behavior

• Managed Private Endpoints (MPE) in Fabric are workspace-scoped and visible only to Admins in the workspace settings UI.
• Members cannot view, create, or manage MPEs. This is by design for security and governance.
• However, using the endpoint (e.g., retrieving secrets via mssparkutils.credentials.getSecret) should work if:
  • The workspace’s managed identity or your user identity has Key Vault permissions (Get/List).
  • The notebook runtime supports private link routing.
• If you get a 403 Forbidden error, it means:
  • The request is not routed through the approved private endpoint (because your session lacks the binding).
  • Or your identity does not have the required RBAC roles on the Key Vault.

Why You Can’t See or Use It

• The UI limitation (Members not seeing MPEs) is documented but confusing. It does not mean you can’t use them—it means you can’t manage them.
• The actual blocker is that Fabric currently uses notebook owner identity for secret retrieval (not the workspace identity), and Members’ requests fail if:
  • Public network access is disabled on Key Vault.
  • Your identity is not authorized via private endpoint routing

What’s Needed

1. Permissions:

   • Your Azure AD account needs:
     • Key Vault Secrets User (for secret retrieval).
     • Key Vault Reader (for vault discovery).
   • The Fabric workspace managed identity also needs Get/List permissions on secrets. [community....rosoft.com]

2. Private Endpoint Routing:

   • Currently, only Admin-created endpoints are active, but routing is tied to the workspace identity.
   • If workspace identity is not supported for notebooks (as of now), your user identity must have access.

Is This a Bug or Missing Feature?

• It’s expected behavior under current design:
  • Members can’t manage MPEs.
  • Secret access depends on identity and RBAC, not just endpoint existence.
• Microsoft roadmap suggests workspace identity support for notebooks is coming, which will fix this gap

Workarounds

• Ask your Admin to:
  • Grant your user Key Vault RBAC roles.
  • Confirm the workspace identity has permissions (future-proof).
• If possible, temporarily enable public network access on Key Vault for testing (not recommended for production).
• Use service principal credentials in the notebook as a fallback (less secure).

Hope this help and if so, Kudos to copilot for the answer!!!