Power BI Service - Key Vault Reference

[kstepha0]

Following this documentation https://learn.microsoft.com/en-us/fabric/data-factory/azure-key-vault-reference-overview

I was successfully able to set up a key vault reference to Key Vault A (KVA) with oAuth credentials.  KVA is not in the same region as the power BI tenant. 

I am now attempting to set up a second key vault reference to Key Vault B (KVB), which is functionally identical to KVA with the exception of the region. KVB is in the same region as the Power BI tenant. OAuth credentials are repeatedly failing.

I've verified the access configuration and credentials, policies, networking restrictions are identical between the two. I attempted to create the key vault reference to KVB while KVB had no network restriction at all. I also attempted with two different sets of user credentials (one as the signed-in Power BI Pro user, and a second set)

OAuth continues to fail. Looking for any insight on the issue. Thanks!

[rohit1991 · Accepted solution]

hI @kstepha0 ,
The issue you're encountering may be related to the regional pairing and backend service limitations in Power BI Service when integrating with Azure Key Vault via OAuth. Even though both Key Vaults have identical configurations, certain Power BI Fabric services can have stricter region affinity or latency-sensitive validations when using OAuth, especially when compared to cross-region scenarios that may rely on slightly different authentication pathways. Since KVA (out-of-region) succeeded while KVB (in-region) is failing, it's possible that Power BI is enforcing stricter OAuth validation or token audience matching due to the regional alignment.

Additionally, OAuth failures can sometimes stem from subtle mismatches in the service principal permissions, Azure AD conditional access policies, or tenant restrictions that behave differently depending on the region. I would suggest verifying whether Managed Identity might provide a more stable alternative for your KVB integration, as Managed Identity often simplifies regional and network dependencies. If OAuth remains essential, it may be best to engage Microsoft support directly to review backend logs, as these types of region-specific authentication issues may require internal diagnostics.

[BhavinVyas3003]

Use Managed Identity instead of OAuth to connect to Key Vault B.

In Azure Key Vault B:

1. Go to Access policies → Add Access Policy
2. Grant Get and List permissions to the Microsoft Fabric Managed Identity search for “Microsoft Fabric” or your workspace name
3. Save changes

Then, in Power BI Service (Data Factory), create the Key Vault reference using Managed Identity.

[kstepha0]

Managed identity is not available as an authentication method in the Key Vault Reference connection feature. 

The workspace managed identity has an access policy on the key vault with Get and List permissions. 

[v-achippa]

Hi @kstepha0,

Thank you for reaching out to Microsoft Fabric Community.

Currently the Key Vault Reference feature in Microsoft Fabric supports only OAuth authentication method. Managed Identity is currently not supported for this feature, even if the workspace has been assigned one.

Since there are OAuth failures with Key Vault B, the issue here is might be due to tenant level settings or regional OAuth token validation differences.

• Instead, try creating an Azure AD App Registration in your tenant. Grant it Get and List permissions on Key Vault B and use that app’s credentials to set up the OAuth connection. This resolves the OAuth related issues.

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it! 

Thanks and regards,

Anjan Kumar Chippa

[v-achippa]

Hi @kstepha0,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution I have provided for the issue worked? or let us know if you need any further assistance.
If my response addressed, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

Thanks and regards,

Anjan Kumar Chippa

[v-achippa]

Hi @kstepha0,

We wanted to kindly follow up to check if the solution I have provided for the issue worked.
If my response addressed, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

Thanks and regards,

Anjan Kumar Chippa

[v-achippa]

Hi @kstepha0,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution I have provided for the issue worked.
If my response addressed, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

Thanks and regards,

Anjan Kumar Chippa