Forum Discussion
Key Vault Reference Configuration
Hi SDHorita
Your Azure AD account needs Key Vault Secrets User (for secret retrieval) and Key Vault Reader (for vault discovery) roles on the Key Vault resource. Contributor and Secret Officer roles don’t grant these specific permissions
ensure Fabric’s system-assigned managed identity is granted Get and List permissions
Hi SDHorita, Thank you for raising this question.
Appreciation to nilendraFabric for providing accurate guidance. The error you're encountering typically occurs when the necessary Azure Key Vault permissions are not correctly assigned to either your Azure AD user account or the Microsoft Fabric system-assigned managed identity.
For the user account, ensure that it has the Key Vault Reader role to enable vault discovery and the Key Vault Secrets User role to allow retrieval of secrets.
For Fabric’s managed identity -- used when accessing secrets during pipeline or dataflow execution -- it must have Get and List permissions on secrets within the Key Vault. These permissions can be granted using Azure RBAC (recommended) by assigning the appropriate roles, or through Access Policies if using the legacy permission model. It's important to avoid mixing RBAC and access policies, as RBAC takes precedence and may override access policy settings.
For detailed steps on configuring this correctly, please refer to the officaial Documentation provided below:
Configure AKV references - Microsoft Fabric | Microsoft Learn
Happy to help! If this addressed your concern, marking it as "Accepted Solution" and giving us "kudos" would be valuable for others in the community.
Thank you.
Hi SDHorita,
May I ask if you have gotten this issue resolved?
If it is solved, please mark the helpful reply or share your solution and accept it as solution, it will be helpful for other members of the community who have similar problems as yours to solve it faster.
Thank you.
Hi SDHorita,
we haven't heard back from you regarding our last response and wanted to check if your issue has been resolved.If our response addressed by the community member for your query, please mark it as Accept Answer and give us Kudos. Should you have any further questions, feel free to reach out.
Thank you for being a part of the Microsoft Fabric Community Forum!
Hi v-sgandrathi,
I have a few questions regarding the Azure Key Vault References setup. When you talk about fabric's managed identity, what do you mean by that? Because there are only workspace identities within Fabric.
Besides if you use "Allow public access from specific virtual networks and IP addresses" in your Azure Key Vault, how does Fabric access this? I consistently get the following error when trying to create an Azure Key Vault Reference when this is setting is enabled on my Key Vault:Is there a way to solve this without opening up the key vault to public access?
Thank you in advance!Hi Lars_Moons,
To address your first question, when we refer to Fabric’s managed identity, we mean the system-assigned managed identity that is automatically created for each Fabric workspace. While you mainly interact with workspace identities, each Fabric workspace has its own managed identity used for secure authentication and access to resources such as Azure Key Vault.
For Key Vault references to function properly, this managed identity needs to be granted the following permissions on the Azure Key Vault:
- Get and List permissions on secrets
- At least the Key Vault Secrets User and Key Vault Reader rolesRegarding network access, if your Key Vault is configured to "Allow public access from specific virtual networks and IP addresses," Fabric services must be explicitly permitted. However, Fabric does not use static IP addresses and currently does not support private endpoint connectivity to Key Vault.
As a result, Key Vaults set to restrict public access will prevent Fabric from connecting, leading to the credential error you are experiencing. Therefore, it is necessary to temporarily set the Key Vault to "Allow public access from all networks" while maintaining access controls through policies or role assignments. This approach is required until Fabric supports more advanced network features such as VNets or private endpoints.
Thank you.
Hi v-sgandrathi, so to confirm. In the picture below, this is the fabric managed identity you are talking about?
If not, where can I find the fabric managed identities?
Thanks again!
