Forum Discussion

mortoman's avatar
mortoman
New Member
1 year ago

Enabling CMK on Fabric Workspaces

Hi all,   I'm trying to enable CMK on my Fabric tenant by following the Microsoft guide Customer-managed keys for Fabric workspaces - Microsoft Fabric | Microsoft Learn. I have done the following: ...
workspaces
JMCK's avatar
JMCK
Frequent Visitor
1 year ago

I encountered the same error message, and to avoid any guesswork, I recommend the following steps:

  1. Enable the Log Analytics Workspace for the Key Vault.
  2. Activate the AuditEvent setting.
  3. Attempt to enable the Customer Managed Key (CMK) at the workspace settings level.
  4. Once these steps are completed, check the AzureDiagnostics in the Logs. Pay special attention to the "KeyUnwrap" operation name, as it was instrumental in resolving my issue.

Additionally, ensure that you have correctly granted access to the Object ID of the Microsoft Fabric CMK application, rather than its App ID. Initially, I mistakenly provided access to the App ID using Terraform, which led to the error.

This was the the error I found in my logs when I was facing the same issue:

Caller is not authorized to perform action on resource.
If role assignments, deny assignments or role definitions were changed recently, please observe propagation time.
Caller: appid=XXXX-XX-XXXX-XXXX-XXXXXX;oid=XXXX-XXX-XX-XX-XXXXXXXX;iss=https://sts.windows.net/XXXXXX-XX-XX-XXX-XXXXXXXX/
Action: 'Microsoft.KeyVault/vaults/keys/read'
Resource: '/subscriptions/AAA-BBBBB-CCCC-DDD-EEEEE/resourcegroups/rg-fabric-dev/providers/microsoft.keyvault/vaults/kv-fabric-dev/keys/cmkfabrictest'
Assignment: (not found)
DenyAssignmentId: null
DecisionReason: null
Vault: kv-fabric-dev;location=youlocation