Overview

When a Fabric Pipeline needs access to Azure Key Vault, the preferred approach is to use DefaultAzureCredential in the notebook and grant Azure Key Vault access to the Fabric Workspace Identity.

In this pattern, access to Azure Key Vault is granted to the Workspace Identity rather than individual users. As a result, authorized workspace users can execute the Pipeline without requiring separate Key Vault permissions. This simplifies administration and reduces the risk of solutions failing when staff members change roles or leave the university.

This pattern is intended for notebooks executed from Fabric Pipelines. Interactive notebook execution will not work with this method.

How It Works

A Fabric Pipeline executes a Notebook. The Notebook uses DefaultAzureCredential to authenticate and retrieve secrets from Azure Key Vault. Access is granted to the Workspace Identity rather than individual users.

Pipeline Configuration

1. Confirm the Workspace Identity is enabled by going to the workspace settings.
2. Confirm the Workspace Identity has permission Key Vault Secrets User on the target Key Vault.
3. Create the Notebook containing the code to access the Key Vault.
4. Add a Notebook activity to a Fabric Pipeline.
5. Select the Notebook with code to access the Key Vault.
6. Run the Pipeline.
7. Review the Notebook output to confirm successful secret retrieval.

Notebook Example

The following example validates that a Notebook can successfully retrieve a secret from Azure Key Vault using the identity available during execution.

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient
from notebookutils import notebook

keyvault_url = "https://your-keyvault-name.vault.azure.net/"
secret_name = "your-secret-name"

try:
    print("Initializing authentication...")
    credential = DefaultAzureCredential()

    print("Connecting to Key Vault...")
    kv_client = SecretClient(
        vault_url=keyvault_url,
        credential=credential
    )

    print("Retrieving secret...")
    secret_value = kv_client.get_secret(secret_name).value

    print("Key Vault access verified")
    print(f"Retrieved secret with length {len(secret_value)}")

    notebook.exit("SUCCESS")

except Exception as ex:
    print(f"Failed: {ex}")
    raise

Understanding the Code

DefaultAzureCredential

DefaultAzureCredential is the recommended authentication mechanism for Azure workloads. It automatically attempts to obtain credentials from the execution environment.

SecretClient

SecretClient provides access to Azure Key Vault secrets. The client is initialized using the Key Vault URL and the credential obtained from DefaultAzureCredential.

Secret Retrieval

The call to get_secret requests a specific secret from the Key Vault.

For validation purposes, it is often sufficient to retrieve a known test secret and verify that access succeeds.

Notebook Exit Status

Returning an explicit status message makes it easier to troubleshoot Pipeline runs and verify successful execution.

notebook.exit("SUCCESS")

If an exception occurs, the Notebook should fail rather than suppressing the error.

Validation Procedure

A successful configuration should produce output similar to:

Initializing authentication...
Connecting to Key Vault...
Retrieving secret...
Key Vault access verified
Retrieved secret with length 32

The actual secret value should never be printed to the Notebook output.

Operational Standard

• For production workloads, grant Azure resource permissions to the Workspace Identity rather than individual users whenever possible.
• Use DefaultAzureCredential within notebooks to authenticate to Azure resources.
• Store secrets in Azure Key Vault.
• Do not hardcode secrets, credentials, or connection strings in notebook code.
• Do not display secret values in notebook output.
• Return clear success and failure messages.
• Ensure authentication and authorization errors are visible in notebook output and Pipeline logs.

References

• Microsoft Fabric Workspace Identity
• Azure Key Vault SDK for Python 
• Azure Identity SDK for Python