Forum Discussion
How to properly authenticate and access Azure Key Vault secrets from a Fabric User Data Function
Hi everyone,
I am trying to use a Fabric User Data Function that pushes metrics to a Mimir/Grafana endpoint via OTLP. In my testing phase, I used hardcoded credentials, but I now need to transition these to Azure Key Vault for production security. I am struggling to find the correct way to "bind" or "authenticate" the UDF to the Key Vault.
UI Limitations: In the UDF Editor under Manage connections, I only see options for the OneLake catalog (Lakehouses, Warehouses).
I want to use the Fabric Identity (Workspace or User) to authenticate against the Key Vault.
Any guidance on the "Fabric-way" to handle external secrets in UDFs would be greatly appreciated!
Hello Izyaan_sc
The Manage Connections in UDF editor is limited to Fabric items, hence you don't see an option to connect to Azure Key Vault.
A better design would be to take authentication outside of UDF. Use Notebooks that have supported credential utilities for Key Vault token operations, making sure you run the Notebook using a service principal SPN. So essentially you are using the Notebook to authenticate and pass the token to the UDF as an argument.
If the SPN calling the Notebook has apprrpriate permissions, it is simply calling the getSecret() method.
token = credentials.getSecret(vault_name, secret_name)
On the UDF side you can pass the token like so -
@udf.context(argName="udfContext")@udf.function()def push_metrics(udfContext: fn.UserDataFunctionContext, otlp_token: str) -> str:Flow:
- Notebook runs as SP (or user)
- Notebook uses Key Vault integration to get secret
- Notebook calls UDF and passes secret as an argument
- UDF sends OTLP to Mimir/Grafana using the passed secret
3 Replies
- deborshi_nag
Super User
Hello Izyaan_sc
The Manage Connections in UDF editor is limited to Fabric items, hence you don't see an option to connect to Azure Key Vault.
A better design would be to take authentication outside of UDF. Use Notebooks that have supported credential utilities for Key Vault token operations, making sure you run the Notebook using a service principal SPN. So essentially you are using the Notebook to authenticate and pass the token to the UDF as an argument.
If the SPN calling the Notebook has apprrpriate permissions, it is simply calling the getSecret() method.
token = credentials.getSecret(vault_name, secret_name)
On the UDF side you can pass the token like so -
@udf.context(argName="udfContext")@udf.function()def push_metrics(udfContext: fn.UserDataFunctionContext, otlp_token: str) -> str:Flow:
- Notebook runs as SP (or user)
- Notebook uses Key Vault integration to get secret
- Notebook calls UDF and passes secret as an argument
- UDF sends OTLP to Mimir/Grafana using the passed secret
v-kpoloju-msftCommunity Support
Hi Izyaan_sc,
Thank you for reaching out to the Microsoft Fabric Community Forum. Also, thanks to deborshi_nag, for those inputs on this thread.Has your issue been resolved? If the response provided by the community member deborshi_nag, addressed your query, could you please confirm? It helps us ensure that the solutions provided are effective and beneficial for everyone.
Hope this helps clarify things and let me know what you find after giving these steps a try happy to help you investigate this further.
Thank you for using the Microsoft Community Forum.- v-kpoloju-msft
Hi Izyaan_sc,
Just checking in to see if the issue has been resolved on your end. If the earlier suggestions helped, that’s great to hear! And if you’re still facing challenges, feel free to share more details happy to assist further.Thank you.