Key Vault Reference - Invalid Credentials

Hi Anonymous 

You're encountering the "The credentials provided for the AzureKeyVault source are invalid" error while trying to set up a Key Vault reference in Microsoft Fabric, which typically points to a misconfiguration in either the Azure Key Vault access policies, Microsoft Fabric-managed identity permissions, or region alignment. Even though you've already reviewed official documentation and community solutions, the issue usually stems from a few core requirements not being fully met or synced. Here's a step-by-step approach you can follow to resolve it comprehensively:

Verify the Key Vault Region: Ensure your Azure Key Vault is in the same region as your Microsoft Fabric workspace. Cross-region Key Vault references are not supported in Microsoft Fabric yet.

Use the Correct Managed Identity: Microsoft Fabric uses a system-assigned managed identity to access resources. Go to your Fabric workspace settings and identify the managed identity used by Fabric. This is the identity that needs access to the Key Vault.

Grant Key Vault Access:

If you're using RBAC, go to the Azure Key Vault > Access control (IAM) and assign the "Key Vault Secrets User" role to the Fabric managed identity.

If you're using the Access Policies (legacy) model, navigate to the Access policies blade in the Key Vault, and explicitly grant the Get and List permissions on secrets to the Fabric managed identity.

Ensure the Key Vault Firewall Allows Access: Your Key Vault must either allow public access or specifically allow the Fabric workspace's IP ranges. If firewall rules are too restrictive, Fabric won't be able to connect, even with proper permissions.

Format the Reference Correctly: In Fabric, ensure you are using the correct syntax for referencing the Key Vault secret, such as @Microsoft.KeyVault(SecretUri=https://<your-vault-name>.vault.azure.net/secrets/<secret-name>).

Check for Secret Versioning: Sometimes referencing a versioned secret causes issues. Use the URI without explicitly referencing a version (i.e., default to the latest).

Verify Secret Exists and Is Enabled: Double-check that the secret exists in the Key Vault and is not disabled or expired.

Allow Time for Permissions to Propagate: After assigning roles or policies, it may take a few minutes (or more) for changes to propagate.

If after following all these steps the issue still persists, try to test access using an Azure CLI or PowerShell script using the same managed identity to isolate whether the issue is with Fabric or Key Vault itself. A successful external call using the managed identity confirms the issue lies within the Fabric integration layer.

Let me know if you want me to provide a real configuration example or ARM template setup for this.