Forum Discussion
Key Vault Reference Configuration
Hi SDHorita
Your Azure AD account needs Key Vault Secrets User (for secret retrieval) and Key Vault Reader (for vault discovery) roles on the Key Vault resource. Contributor and Secret Officer roles don’t grant these specific permissions
ensure Fabric’s system-assigned managed identity is granted Get and List permissions
Hi SDHorita
Your Azure AD account needs Key Vault Secrets User (for secret retrieval) and Key Vault Reader (for vault discovery) roles on the Key Vault resource. Contributor and Secret Officer roles don’t grant these specific permissions
ensure Fabric’s system-assigned managed identity is granted Get and List permissions
Is that true? If you check the specific actions associated to each role:
- User acctions:
| DataActions | ||
| Microsoft.KeyVault/vaults/secrets/getSecret/action | ||
| Microsoft.KeyVault/vaults/secrets/readMetadata/action
- Officer:
|
So User actions are included in Officer actions.
On the other hand, according to documentation (Azure Key Vault Reference overview (Preview) - Microsoft Fabric | Microsoft Learn), you don't have to ensure Fabric’s system-assigned managed identity is granted Get and List permissions, doc says thet just with your Entra ID you are allowing Fabric to access:
When you add an Azure Key Vault reference in Fabric, the service records the vault URI and the secret name by using Microsoft Entra ID OAuth 2.0 consent. During the consent flow, you grant Fabric’s system-assigned managed identity Get and List permissions on the specified secrets; the secret values themselves never leave the key vault.