Key Vault Reference Configuration

[SDHorita]

Hello,

I am attempting to test the "Key Vault References" feature for connections from Fabric, but I am unable to connect to the key vault resource.  The error that I am getting is that the credentials are invalid.

I am logging in using AD, so the credentials should be fine.  My guess is that I need a different role on the key vault resource, but I'm not sure which one, I have contributor and secret officer currently and the documentation (https://learn.microsoft.com/en-us/fabric/data-factory/azure-key-vault-reference-configure) doesn't seem to indicate what permission is needed.

Does anyone know what role or account setting is needed to be able to create the reference?

Thanks.

[v-sgandrathi]

Hi @SDHorita, Thank you for raising this question.

Appreciation to @nilendraFabric for providing accurate guidance. The error you're encountering typically occurs when the necessary Azure Key Vault permissions are not correctly assigned to either your Azure AD user account or the Microsoft Fabric system-assigned managed identity.

For the user account, ensure that it has the Key Vault Reader role to enable vault discovery and the Key Vault Secrets User role to allow retrieval of secrets.

For Fabric’s managed identity -- used when accessing secrets during pipeline or dataflow execution -- it must have Get and List permissions on secrets within the Key Vault. These permissions can be granted using Azure RBAC (recommended) by assigning the appropriate roles, or through Access Policies if using the legacy permission model. It's important to avoid mixing RBAC and access policies, as RBAC takes precedence and may override access policy settings.

For detailed steps on configuring this correctly, please refer to the officaial Documentation provided below:
Configure AKV references - Microsoft Fabric | Microsoft Learn

Happy to help! If this addressed your concern, marking it as "Accepted Solution" and giving us "kudos" would be valuable for others in the community.

Thank you.

[Lars_Moons]

Hi @v-sgandrathi,

I have a few questions regarding the Azure Key Vault References setup. When you talk about fabric's managed identity, what do you mean by that? Because there are only workspace identities within Fabric.

Besides if you use "Allow public access from specific virtual networks and IP addresses" in your Azure Key Vault, how does Fabric access this? I consistently get the following error when trying to create an Azure Key Vault Reference when this is setting is enabled on my Key Vault:

Is there a way to solve this without opening up the key vault to public access?

Thank you in advance!

[v-sgandrathi]

Hi @Lars_Moons,

To address your first question, when we refer to Fabric’s managed identity, we mean the system-assigned managed identity that is automatically created for each Fabric workspace. While you mainly interact with workspace identities, each Fabric workspace has its own managed identity used for secure authentication and access to resources such as Azure Key Vault.

For Key Vault references to function properly, this managed identity needs to be granted the following permissions on the Azure Key Vault:
- Get and List permissions on secrets
- At least the Key Vault Secrets User and Key Vault Reader roles

Regarding network access, if your Key Vault is configured to "Allow public access from specific virtual networks and IP addresses," Fabric services must be explicitly permitted. However, Fabric does not use static IP addresses and currently does not support private endpoint connectivity to Key Vault.

As a result, Key Vaults set to restrict public access will prevent Fabric from connecting, leading to the credential error you are experiencing. Therefore, it is necessary to temporarily set the Key Vault to "Allow public access from all networks" while maintaining access controls through policies or role assignments. This approach is required until Fabric supports more advanced network features such as VNets or private endpoints.

Thank you.

[Lars_Moons]

Hi @v-sgandrathi, so to confirm. In the picture below, this is the fabric managed identity you are talking about?

If not, where can I find the fabric managed identities?

Thanks again!

[v-sgandrathi]

Hi @Lars_Moons,

Yes, to confirm, the identity shown in your picture is the Fabric-managed identity we are referencing. This is the system-assigned managed identity automatically generated for your specific Fabric workspace.

This identity is used by Power BI/Fabric to securely authenticate when connecting to external services such as Azure Key Vault. You will need to assign the appropriate permissions (like "Get" and "List" for secrets) and roles (such as Key Vault Secrets User and Key Vault Reader) to this identity in your Key Vault’s Access Control (IAM) settings.

Thank you.

[v-sgandrathi]

Hi @SDHorita,

May I ask if you have gotten this issue resolved?

If it is solved, please mark the helpful reply or share your solution and accept it as solution, it will be helpful for other members of the community who have similar problems as yours to solve it faster.

Thank  you.

[v-sgandrathi]

Hi @SDHorita,

we haven't heard back from you regarding our last response and wanted to check if your issue has been resolved.

If our response addressed by the community member for  your query, please mark it as Accept Answer and give us Kudos. Should you have any further questions, feel free to reach out.
Thank you for being a part of the Microsoft Fabric Community Forum!

[nilendraFabric · Accepted solution]

Hi @SDHorita 

Your Azure AD account needs Key Vault Secrets User (for secret retrieval) and Key Vault Reader (for vault discovery) roles on the Key Vault resource. Contributor and Secret Officer roles don’t grant these specific permissions

ensure Fabric’s system-assigned managed identity is granted Get and List permissions

[amaaiia]

Is that true? If you check the specific actions associated to each role:

- User acctions:

DataActions

Microsoft.KeyVault/vaults/secrets/getSecret/action

Microsoft.KeyVault/vaults/secrets/readMetadata/action - Officer: DataActions Microsoft.KeyVault/vaults/secrets/*

 So User actions are included in Officer actions.

On the other hand, according to documentation (Azure Key Vault Reference overview (Preview) - Microsoft Fabric | Microsoft Learn), you don't have to ensure Fabric’s system-assigned managed identity is granted Get and List permissions, doc says thet just with your Entra ID you are allowing Fabric to access:

When you add an Azure Key Vault reference in Fabric, the service records the vault URI and the secret name by using Microsoft Entra ID OAuth 2.0 consent. During the consent flow, you grant Fabric’s system-assigned managed identity Get and List permissions on the specified secrets; the secret values themselves never leave the key vault.