Forum Discussion
Power BI Service - Key Vault Reference
Following this documentation https://learn.microsoft.com/en-us/fabric/data-factory/azure-key-vault-reference-overview
I was successfully able to set up a key vault reference to Key Vault A (KVA) with oAuth credentials. KVA is not in the same region as the power BI tenant.
I am now attempting to set up a second key vault reference to Key Vault B (KVB), which is functionally identical to KVA with the exception of the region. KVB is in the same region as the Power BI tenant. OAuth credentials are repeatedly failing.
I've verified the access configuration and credentials, policies, networking restrictions are identical between the two. I attempted to create the key vault reference to KVB while KVB had no network restriction at all. I also attempted with two different sets of user credentials (one as the signed-in Power BI Pro user, and a second set)
OAuth continues to fail. Looking for any insight on the issue. Thanks!
hI kstepha0 ,
The issue you're encountering may be related to the regional pairing and backend service limitations in Power BI Service when integrating with Azure Key Vault via OAuth. Even though both Key Vaults have identical configurations, certain Power BI Fabric services can have stricter region affinity or latency-sensitive validations when using OAuth, especially when compared to cross-region scenarios that may rely on slightly different authentication pathways. Since KVA (out-of-region) succeeded while KVB (in-region) is failing, it's possible that Power BI is enforcing stricter OAuth validation or token audience matching due to the regional alignment.Additionally, OAuth failures can sometimes stem from subtle mismatches in the service principal permissions, Azure AD conditional access policies, or tenant restrictions that behave differently depending on the region. I would suggest verifying whether Managed Identity might provide a more stable alternative for your KVB integration, as Managed Identity often simplifies regional and network dependencies. If OAuth remains essential, it may be best to engage Microsoft support directly to review backend logs, as these types of region-specific authentication issues may require internal diagnostics.
7 Replies
Use Managed Identity instead of OAuth to connect to Key Vault B.
In Azure Key Vault B:
- Go to Access policies → Add Access Policy
- Grant Get and List permissions to the Microsoft Fabric Managed Identity search for “Microsoft Fabric” or your workspace name
- Save changes
Then, in Power BI Service (Data Factory), create the Key Vault reference using Managed Identity.
Managed identity is not available as an authentication method in the Key Vault Reference connection feature.
The workspace managed identity has an access policy on the key vault with Get and List permissions.
Hi kstepha0,
Thank you for reaching out to Microsoft Fabric Community.
Currently the Key Vault Reference feature in Microsoft Fabric supports only OAuth authentication method. Managed Identity is currently not supported for this feature, even if the workspace has been assigned one.
Since there are OAuth failures with Key Vault B, the issue here is might be due to tenant level settings or regional OAuth token validation differences.
- Instead, try creating an Azure AD App Registration in your tenant. Grant it Get and List permissions on Key Vault B and use that app’s credentials to set up the OAuth connection. This resolves the OAuth related issues.
If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!
Thanks and regards,
Anjan Kumar Chippa
hI kstepha0 ,
The issue you're encountering may be related to the regional pairing and backend service limitations in Power BI Service when integrating with Azure Key Vault via OAuth. Even though both Key Vaults have identical configurations, certain Power BI Fabric services can have stricter region affinity or latency-sensitive validations when using OAuth, especially when compared to cross-region scenarios that may rely on slightly different authentication pathways. Since KVA (out-of-region) succeeded while KVB (in-region) is failing, it's possible that Power BI is enforcing stricter OAuth validation or token audience matching due to the regional alignment.Additionally, OAuth failures can sometimes stem from subtle mismatches in the service principal permissions, Azure AD conditional access policies, or tenant restrictions that behave differently depending on the region. I would suggest verifying whether Managed Identity might provide a more stable alternative for your KVB integration, as Managed Identity often simplifies regional and network dependencies. If OAuth remains essential, it may be best to engage Microsoft support directly to review backend logs, as these types of region-specific authentication issues may require internal diagnostics.
