Forum Discussion
Enabling CMK on Fabric Workspaces
I encountered the same error message, and to avoid any guesswork, I recommend the following steps:
- Enable the Log Analytics Workspace for the Key Vault.
- Activate the AuditEvent setting.
- Attempt to enable the Customer Managed Key (CMK) at the workspace settings level.
- Once these steps are completed, check the AzureDiagnostics in the Logs. Pay special attention to the "KeyUnwrap" operation name, as it was instrumental in resolving my issue.
Additionally, ensure that you have correctly granted access to the Object ID of the Microsoft Fabric CMK application, rather than its App ID. Initially, I mistakenly provided access to the App ID using Terraform, which led to the error.
This was the the error I found in my logs when I was facing the same issue:
Caller is not authorized to perform action on resource.
If role assignments, deny assignments or role definitions were changed recently, please observe propagation time.
Caller: appid=XXXX-XX-XXXX-XXXX-XXXXXX;oid=XXXX-XXX-XX-XX-XXXXXXXX;iss=https://sts.windows.net/XXXXXX-XX-XX-XXX-XXXXXXXX/
Action: 'Microsoft.KeyVault/vaults/keys/read'
Resource: '/subscriptions/AAA-BBBBB-CCCC-DDD-EEEEE/resourcegroups/rg-fabric-dev/providers/microsoft.keyvault/vaults/kv-fabric-dev/keys/cmkfabrictest'
Assignment: (not found)
DenyAssignmentId: null
DecisionReason: null
Vault: kv-fabric-dev;location=youlocation
Hi JMCK,
To rule out human error I set everything up again, so my setup is,
New Key vault (purge protection and soft delete enabled)
New RSA key
Recreated the Fabric Platform CMK app security principal with the Microsoft App ID
Assigned the role Key Vault Crypto Service Encryption User to the security principal at both the key vault and the key (just to be sure)
Checked that the role is assigned to the correct object ID as you advised, which it is.
Checked Fabric tenant has CMK enabled
created a new empty workspace
added the key ID to the encryption settings for enabling CMK on the workspace
got the exact same error message.
I had enabled audit logging prior to all this as you suggested and got nothing in the logs relating to key issues!! I thought that was strange so I wrote a simple KQL to pull everything back to check logging was working and indeed everything comes back, but nothing related to the CMK key events.
Checked the logs again and again, but nothing related to key unwrap etc in there at all.
Its like its not even getting that far.
In desparation, I created a brand new Azure tenant and took out a new Fabric F2 capacity, I then did everything to the letter as per the Microsoft guide and it all worked first time (see below)!
I don't have control of the company platform so there must be something they have set to block this from completing. Thanks so much for all your advice, I'll keep going as I'm determined to find out what's stopping this now.
cheers