Forum Discussion

girishtharwani2's avatar
girishtharwani2
Helper III
1 year ago
Solved

Azure Keyvault integration to Fabric Data Factory

I am looking for a way to integrate Azure Key Vault into Fabric Data Factory pipelines. Unfortunately, I haven't had any success so far. Any suggestions on how to achieve this integration?

 

Thanks,

Girish

General Question
Pipeline
  • NandanHegde's avatar
    NandanHegde
    1 year ago

    When you state integration of Key vault in fabric data pipelines, can you please state whether it is in the ocnnections or within the pipeline?

    Unfortunately, KV integration within connections is not available as of today.

     

    Within pipelines, you can use web activity and KV rest API to get the secert values

  • Anonymous's avatar
    Anonymous
    1 year ago

    Hi girishtharwani2 ,

    I wanted to follow up since we haven't heard back from you regarding our last response. We hope your issue has been resolved.
    If the community member's answer your query, please mark it as "Accept as Solution" and select "Yes" if it was helpful.
    If you need any further assistance, feel free to reach out.

    Thank you,
    Pavan.

5 Replies

  • NandanHegde's avatar
    NandanHegde
    Super User
    1 year ago

    When you state integration of Key vault in fabric data pipelines, can you please state whether it is in the ocnnections or within the pipeline?

    Unfortunately, KV integration within connections is not available as of today.

     

    Within pipelines, you can use web activity and KV rest API to get the secert values

  • Anonymous's avatar
    Anonymous
    Not applicable
    1 year ago
     
    Thanks for reaching out in Microsoft Community Forum
     
    Key Vault integration with Fabric data factory is not available but within pipelines you can use webactivity and key vault REST API to get secret values
     
    To retrieve secret values from Azure Key Vault within a Fabric Data Factory pipeline using Web Activity and Key Vault REST API, follow these steps:
     
    Step 1: Grant Permissions to Access Key Vault
    Go to the Azure portal and navigate to your Azure Key Vault.
    Assign appropriate permissions
     
    step 2; If using Managed Identity, ensure the Fabric Data Factory's Managed Identity has Get access on secrets.
    If using Service Principal, grant similar permissions to the Service Principal.
     
    step 3; Obtain the Key Vault REST API URL
    The base URL for Key Vault REST API is: https://<YourKeyVaultName>.vault.azure.net/
    To access a specific secret, append the secret name: https://<YourKeyVaultName>.vault.azure.net/secrets/<SecretName>?api-version=7.3
     
    step 4; Configure Web Activity in Fabric Data Factory
     
    URL: Enter the Key Vault secret URL (https://<YourKeyVaultName>.vault.azure.net/secrets/<SecretName>?api-version=7.3).
    Method: Set to GET.
    Authentication:
    For Managed Identity:
    Select the Managed Identity option.
    Ensure the Managed Identity has access to the Key Vault.
    For Service Principal:
    Obtain an Access Token from Azure AD and pass it in the Authorization header.
     
    Add a header with the following key-value pair: Authorization: Bearer <AccessToken>
    Step 5: Get an Access Token (If Using Service Principal)
    Add a separate Web Activity to retrieve an Azure AD token using the OAuth 2.0 token endpoint:
     
    URL: https://login.microsoftonline.com/<TenantID>/oauth2/v2.0/token
    Method: POST
    Body:
    {
      "grant_type": "client_credentials",
      "client_id": "<ServicePrincipalClientID>",
      "client_secret": "<ServicePrincipalSecret>",
    }
    Headers:
    Content-Type: application/x-www-form-urlencoded
     
    5.Capture the token response in the output of this activity.
     
    6. Link Access Token to Key Vault Web Activity
    In the Key Vault Web Activity, use the output of the token retrieval activity for the Authorization header:
    Use dynamic content to reference the token: @concat('Bearer ', activity('GetTokenActivityName').output.access_token)
     
    7. Use Retrieved Secret Value
    The Key Vault API returns the secret value in the value property of the JSON response.
    Pass this output dynamically to subsequent pipeline activities: @activity('GetSecretActivityName').output.value
     
    If you found this post helpful, please consider marking it as "Accept as Solution" to help other members find it more easily.
     
     Thanks,
     Pavan.
    • GarryH's avatar
      GarryH
      New Member
      1 year ago

      What do you do if it is ServicePrincipalSecret that you are trying to retrieve from the key vault?

    • ToddChitt's avatar
      ToddChitt
      Super User
      1 year ago

      Hello Anonymous 

      I came across this post while trying to get a Fabric Pipeline Web activity to connect to an Azure Key Vault and retireve a Secret Value. I am having trouble:

      You state: "step 2; If using Managed Identity, ensure the Fabric Data Factory's Managed Identity has Get access on secrets.

      If using Service Principal, grant similar permissions to the Service Principal."
       
      Fabric Data Factory's Managed Identity? Where is that? Is that the Workspace Identity from Workspace Settings? 
       
      For step 4, you state that for Managed Identity...
      But that is not an option in Web Activity's Connection Properties. For Authentication Kind, I see: Anonymous, Basic, and Service principle.
       
      What am I missing?
  • Anonymous's avatar
    Anonymous
    Not applicable
    1 year ago

    Hi girishtharwani2 ,

    I wanted to follow up since we haven't heard back from you regarding our last response. We hope your issue has been resolved.
    If the community member's answer your query, please mark it as "Accept as Solution" and select "Yes" if it was helpful.
    If you need any further assistance, feel free to reach out.

    Thank you,
    Pavan.