Forum Discussion
Support for Azure Key Vault Access using Fabric Workspace Managed Identity
We have a use case where we need to access secrets in Azure Key Vault (located behind a firewall) from a Fabric Notebook. We successfully created a managed private endpoint from Fabric to Key Vault for network access, and can retrieve secrets in Fabric Notebook using logged-in user credentials.
However, when attempting to connect to Key Vault during scheduled runs, such as from a Data Factory Pipeline, we encounter issues. Our plan was to use the Fabric workspace managed identity, but this approach is not working.
Based on several blogs, including Run Notebooks in Pipelines with Service Principal or Workspace Identity | Microsoft Fabric Blog | M…, using workspace identity should be possible, but I am unable to establish a connection using workspace identity. For example, when creating an `Azure Keyvault Service`, only `Service Principal` is supported, which does not meet our requirements.
Is there any workaround or method to use Fabric workspace identity for connecting to Azure Key Vault and accessing secrets? As we are migrating our workloads to Fabric, secure access to Key Vault secrets is essential, and this limitation is currently blocking our progress. Any guidance or support would be greatly appreciated.
I can provide any more details as required.
7 Replies
Hi curiousan,
Thank you for reaching out to the Microsoft Fabric Community Forum and your setup is correct, and the issue you are facing is due to a current limitation in Microsoft Fabric.
While Fabric notebooks can access Azure Key Vault using your logged-in user or managed identity during interactive runs, this does not extend to pipeline or scheduled executions yet. Now, workspace managed identity is not supported for Azure Key Vault connections in Data Factory pipelines or linked services, which is why you're only seeing the Service Principal option.
To proceed, the recommended and supported approach is to use a Service Principal (App Registration) for authentication. You can securely configure this by granting the Service Principal access to your Key Vault (via Access Policies or RBAC) and then using it in your Fabric Key Vault connection. I understand your preference for managed identity, especially for security reasons, but currently this scenario is not fully supported in Fabric pipeline executions. As a workaround, you may continue using managed identity within notebooks for interactive scenarios, but for scheduled runs, Service Principal is the reliable option.
Hopefully, this capability will be enhanced in future updates. If you have any questions, feel free to reach out to us. We will be happy to help.Hi v-kpoloju-msft thanks for the update,
we have organization wide policy that do not allow usages of secret/key/certificate for Entra app. Can i have some workaround without using Entra ID + Secret based authentication?
Hi curiousan,
Thanks for the clarification that makes sense given your organizations policy.
Currently, Microsoft Fabric does not support accessing Azure Key Vault in pipeline or scheduled runs using workspace managed identity or any fully secret-less authentication. So avoiding both client secrets and certificates while still enabling automated access isn’t achievable natively at this time.
If your policy allows, you could consider certificate based authentication with a Service Principal as a more secure alternative to secrets. Otherwise, options are limited to user-based (interactive) runs or handling Key Vault access externally (e.g., via Azure services with Managed Identity) and passing values into Fabric. At present, there is no fully supported workaround within Fabric that satisfies all these constraints together.
Hi curiousan ,
Hope everything is working fine now. If you still need any additional details or clarification from our side, please feel free to let us know.
Thank you.
Hi v-kpoloju-msft V-yubandi-msft No we haven't found any resolution for this yet. Currently we are working with the internal Fabric team to find a work around. There might be a way to create a connection using workspace identity and use that to trigger the pipeline running notebook that fetch the secret.
Hi curiousan,
Thank you for the update. I understand that the issue is still being investigated with the internal Fabric team and that no confirmed resolution has been identified yet. The workaround approach you mentioned, involving Workspace Identity to create the connection and trigger the pipeline notebook for secret retrieval, sounds like a reasonable direction to explore while the investigation continues. Please keep us posted on any progress or findings from the Fabric team, and feel free to share additional details if you would like us to review or assist further from our side.
Hi curiousan,
Just wanted to follow up. If the shared guidance worked for you, that’s wonderful hopefully it also helps others looking for similar answers. If there’s anything else you'd like to explore or clarify, don’t hesitate to reach out.Thank you.
