Forum Discussion
Power BI Service - Key Vault Reference
hI kstepha0 ,
The issue you're encountering may be related to the regional pairing and backend service limitations in Power BI Service when integrating with Azure Key Vault via OAuth. Even though both Key Vaults have identical configurations, certain Power BI Fabric services can have stricter region affinity or latency-sensitive validations when using OAuth, especially when compared to cross-region scenarios that may rely on slightly different authentication pathways. Since KVA (out-of-region) succeeded while KVB (in-region) is failing, it's possible that Power BI is enforcing stricter OAuth validation or token audience matching due to the regional alignment.Additionally, OAuth failures can sometimes stem from subtle mismatches in the service principal permissions, Azure AD conditional access policies, or tenant restrictions that behave differently depending on the region. I would suggest verifying whether Managed Identity might provide a more stable alternative for your KVB integration, as Managed Identity often simplifies regional and network dependencies. If OAuth remains essential, it may be best to engage Microsoft support directly to review backend logs, as these types of region-specific authentication issues may require internal diagnostics.
Managed identity is not available as an authentication method in the Key Vault Reference connection feature.
The workspace managed identity has an access policy on the key vault with Get and List permissions.
Hi kstepha0,
Thank you for reaching out to Microsoft Fabric Community.
Currently the Key Vault Reference feature in Microsoft Fabric supports only OAuth authentication method. Managed Identity is currently not supported for this feature, even if the workspace has been assigned one.
Since there are OAuth failures with Key Vault B, the issue here is might be due to tenant level settings or regional OAuth token validation differences.
- Instead, try creating an Azure AD App Registration in your tenant. Grant it Get and List permissions on Key Vault B and use that app’s credentials to set up the OAuth connection. This resolves the OAuth related issues.
If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!
Thanks and regards,
Anjan Kumar Chippa
Hi kstepha0,
As we haven’t heard back from you, we wanted to kindly follow up to check if the solution I have provided for the issue worked? or let us know if you need any further assistance.
If my response addressed, please mark it as "Accept as solution" and click "Yes" if you found it helpful.Thanks and regards,
Anjan Kumar Chippa
Hi @kstepha0,
We wanted to kindly follow up to check if the solution I have provided for the issue worked.
If my response addressed, please mark it as "Accept as solution" and click "Yes" if you found it helpful.Thanks and regards,
Anjan Kumar Chippa