Using Key Vault References within Notebooks

[CoulterJames2]

I have an Azure Key Vault (AKV) which is in a different Azure tenant from my Fabric capacity. I have created some key vault secrets that I want to reference within a notebook to use for an API call. My understanding is that, whilst we can create AKV connections under the "Manage connections and gateways" page, this is primarily for retrieving secrets used to authenticate to external data connections in pipelines and Dataflows. 

In Notebooks, we have an option to create connections through the side pane as follows: 

If I create an Azure Key Vault connection here, can I use it in the Notebook to retrieve secrets? I haven't seen an example of it and the notebookutils.credentials.getSecret() method does not accept an alias, only the full vault URI, so what is the point of being a ble to create a Key Vault Reference here? Essentially what I am looking for is:

username = notebookutils.credentials.getSecret(<AKV-alias>, username_secret_name)

password = notebookutils.credentials.getSecret(<AKV-alias>, password_secret_name)

Is this possible?

[v-abhinavmu]

Hi @CoulterJames2, 

I just wanted to follow up and check whether your IT team was able to raise a support ticket for this issue.

If a support ticket has been created, could you please share the ticket link (or the support case number, if you're comfortable doing so)? It would be helpful for others in the community who may encounter the same issue, and it can also help us track any updates or resolution.

Looking forward to hearing from you. Thanks!

[tayloramy]

Hi @CoulterJames2, 

If you go to manage connections and gateways, then under connections find the keyvault connection, the connection type will be Azure Keyvault Service. From there you can get the connection ID. Try calling the GetSecretWithConnection using that ID. 

[CoulterJames2]

Hi @tayloramy unfortunately I couldn't get that to work - the connection shows as Offline in the side pane and when I try to run the code to retrieve the credentials it fails.

[tayloramy]

Hi @CoulterJames2, if manually entering the connection ID into the GetSecretWithConnection function doesn't work, then I can only assume that cross tenant key vaults is not supported. 
I'd recommend to raise a ticket with Microsoft to confirm this. 

[v-abhinavmu]

Hi @CoulterJames2,

Thanks for reaching out to the Microsoft Fabric Community forum.

Following @tayloramy 's suggestion, were you able to raise a Microsoft support ticket? If so, could you please share any updates or findings? It would be helpful to know whether there are any confirmations regarding support for cross-tenant Key Vaults.

Thanks @tayloramy  for the suggestion.

[CoulterJames2]

I don't have the ability to raise support tickets myself so I will reach out to our IT team on this. 

[v-abhinavmu]

Hi @CoulterJames2,

Thanks for the update. That sounds like a good plan. Hopefully your IT team will be able to raise a support ticket and help investigate the issue further. Please feel free to share any updates here, as they may also help others facing a similar problem.

Thank you.

[CoulterJames2]

I have raised the issue with the product team via the Microsoft Partner community. It is currently under investigation.

[CoulterJames2]

Unfortunately because the connection is offline, the "Add as code cell" option is disabled. I don't know why the key vault connection is offline. I have authenticated with a Service Principal and the SP has Key Vault Secrets User role on the AKV (note: the AKV is in a different tenant to the Fabric capacity, but is publicly accessible).

[tayloramy]

Hi @CoulterJames2, 

You can click on the ... beside the connection name, and add it as a code cell" 

That will give you a code cell like this: 

which you can use to get the secrets. 

Note, this seems to not work if the vault does not have public internet access, even with a privat eendpoint to the workspace, if public internet access is disabled, the coonnection in the notebook will fail.