Fabric notebook access to sharepoint auth

Hi EduardD 

Can Fabric notebooks read the secret directly from Azure Key Vault?

Yes try like below and its works for you
Fabric Notebooks have built-in integration with Azure Key Vault. Store all sensitive secrets in Key Vault, assign your service principal the least-privileged access, and read secrets at runtime using the built-in mssparkutils.credentials.getSecret function (or notebookutils.credentials.getSecret depending on your Fabric version).

Example (Python code snippet):

python
secret = mssparkutils.credentials.getSecret("https://<your-key-vault-name>.vault.azure.net/", "your-secret-name")
This method ensures secrets never appear in code or logs, can be centrally rotated, and are auditable.

Prerequisite: Your service principal (or whoever runs the notebook) must have the correct Key Vault read permissions (using RBAC).

2.If you use a Spark notebook, can you securely store/read secrets there?

The same mechanisms to access Azure Key Vault (as above) apply to Spark notebooks in Fabric. Use mssparkutils.credentials.getSecret or its Spark equivalent to fetch secrets securely.

No secrets need to be committed in code or stored in Spark configs.

If this helped, please consider giving kudos and mark as a solution

Hey EduardD,

You can try the following best options within Microsoft Fabric:

1. Use Azure Key Vault: Yes, Fabric Notebooks (Python or Spark) can securely read secrets from Azure Key Vault. This is the most secure and scalable way to manage secrets. Steps:

• Create a linked service to Azure Key Vault in your Fabric workspace.

• Assign the correct Key Vault access policy to your service principal.

• Use mssparkutils.credentials.getSecret("linkedServiceName", "secretName") in your notebook to retrieve the secret.

Works with both Python and Spark notebooks.

2. Workspace Parameters (Not for Secrets): Fabric workspace parameters are useful for reusable values, but not recommended for storing secrets, even if encrypted. They are visible to users with access to the workspace.

Avoid using this for client secrets in production automation.

3. Environment Variables (Limited in Fabric): You can define environment variables inside the notebook session, but they don’t persist securely and aren’t ideal for secrets unless controlled by a secure external system.

4. Spark Notebooks - Secret Storage: If you switch to a Spark notebook, secret handling via Key Vault remains the best option. The mssparkutils utility works in both Spark and non-Spark notebooks.

For Detailed Information:

Use Azure Key Vault with Microsoft Fabric Notebooks

Best Practices for Managing Secrets in Azure Key Vault

Configure Linked Services in Microsoft Fabric

If you found this solution helpful, please consider accepting it and giving it a kudos (Like) it’s greatly appreciated and helps others find the solution more easily.

Best Regards,
Nasif Azam