Forum Discussion
Key Vault Reference Configuration
Hi SDHorita
Your Azure AD account needs Key Vault Secrets User (for secret retrieval) and Key Vault Reader (for vault discovery) roles on the Key Vault resource. Contributor and Secret Officer roles don’t grant these specific permissions
ensure Fabric’s system-assigned managed identity is granted Get and List permissions
Hi Lars_Moons,
To address your first question, when we refer to Fabric’s managed identity, we mean the system-assigned managed identity that is automatically created for each Fabric workspace. While you mainly interact with workspace identities, each Fabric workspace has its own managed identity used for secure authentication and access to resources such as Azure Key Vault.
For Key Vault references to function properly, this managed identity needs to be granted the following permissions on the Azure Key Vault:
- Get and List permissions on secrets
- At least the Key Vault Secrets User and Key Vault Reader roles
Regarding network access, if your Key Vault is configured to "Allow public access from specific virtual networks and IP addresses," Fabric services must be explicitly permitted. However, Fabric does not use static IP addresses and currently does not support private endpoint connectivity to Key Vault.
As a result, Key Vaults set to restrict public access will prevent Fabric from connecting, leading to the credential error you are experiencing. Therefore, it is necessary to temporarily set the Key Vault to "Allow public access from all networks" while maintaining access controls through policies or role assignments. This approach is required until Fabric supports more advanced network features such as VNets or private endpoints.
Thank you.
Hi v-sgandrathi, so to confirm. In the picture below, this is the fabric managed identity you are talking about?
If not, where can I find the fabric managed identities?
Thanks again!
Hi Lars_Moons,
Yes, to confirm, the identity shown in your picture is the Fabric-managed identity we are referencing. This is the system-assigned managed identity automatically generated for your specific Fabric workspace.
This identity is used by Power BI/Fabric to securely authenticate when connecting to external services such as Azure Key Vault. You will need to assign the appropriate permissions (like "Get" and "List" for secrets) and roles (such as Key Vault Secrets User and Key Vault Reader) to this identity in your Key Vault’s Access Control (IAM) settings.
Thank you.