Azure on Hat Full of Data

Get Secret from Azure Key Vault in a Microsoft Fabric Notebook

Thu, 21 Aug 2025 16:33:55 +0000

I’ve recently been working with Notebooks in Microsoft Fabric and have needed to get a credentials information that should be kept secure. The obvious place to store such credentials is Azure Key Vault so now we need to get our secret from there.

This is a really short post to help me out when I need a fast explanation on projects.

Azure Key Vault Part

I’ve previously blogged how to setup a key vault and add a secret – https://hatfullofdata.blog/create-azure-key-vault-to-store-id-and-secret/.

For this post I have a vault called LGB-Secrets and it has a secret called SPConnectorSecret.

The vault URI is https://lgb-secrets.vault.azure.net/ which can be calculated from the vault name.

Python to Get Secret from Azure Key Vault

Notebookutils is a built in package for Microsoft Fabric notebooks. It was previously known as MSSparkUtils. It contains plenty of really useful methods to perform tasks with files, environments and credentials. Microsoft’s documentation can be found at :

https://learn.microsoft.com/en-us/fabric/data-engineering/notebook-utilities#credentials-utilities

The method notebookutils.credentials.getSecret requires 2 parameters, vault URI and secret name. This code block looks like this.

1
2
3
4


azure_key_vault_name = "lgb-secrets"
azure_key_vault_secret_name = "SPConnectorSecret"
azure_key_vault_url = f"https://{azure_key_vault_name}.vault.azure.net/" 
client_secret = notebookutils.credentials.getSecret(azure_key_vault_url,azure_key_vault_secret_name)

The account being used to run the notebook will need access to the key vault.

Reacted!

The notebook understands that the value you fetched from the key vault should be kept secure. So if you try to print the client_secret it will not show you the result and will show REDACTED instead.

Conclusion

I know this is a very short post, which is a good thing as that means its a simple concept. It is here because I also wanted a short post that contains the code block I want to be able to copy and use easily.

Use Power Automate to Fetch Secrets from Key Vault

Wed, 29 May 2024 08:34:09 +0000

Once you have stored security details in Azure Key Vault as described in the previous post in this series (Create Azure Key Vault to store Tenant ID, Client ID and Secret) you need a way to fetch secrets when you need them. Power Automate connector for Azure Key Vault includes the Get Secret action. This post shows you how to build a reusable child flow to fetch secrets.

This post is part of Power Automate and Power BI Rest API series.

Flow design

The flow we are going to create will be called by other flows, so is a child flow. The flow will have one parameter of the prefix of the ClientID and Secret store in the Azure Key Vault. If you have completed the previous post this would be PBI–Workspace. It will return 3 values, TenantID, ClientID and Secret which will be secured

Because we are using child flows we need to create our flows inside a solution. I recommend creating a solution for these group of flows. I don’t want to make this blog post even longer so please go google creating Power Platform solutions.

Setting up the Trigger

For a child flow we use a instant flow. Type in a descriptive name and select the trigger Manually trigger a flow. When you are in the flow editor, expand the trigger and add an input for the prefix. Adding hint text will help you and other users remember what the input is about.

Adding Actions to Fetch Secrets

The flow is reasonably simple with three repeating actions to fetch secrets. Add an action and search for Key Vault and select it. Then from the list select Get Secret. If this is the first time you have connected to a Key Vault you will need to type in the key vault name and click Sign in. Be aware that every key vault has its own connection.

The action has a very simple drop down. For the TenantID action you can just select it from the drop down. For the ClientID and Secret we want to the prefix value from the trigger so that this flow is reusable. So for the ClientID and Secret select Enter custom value. Then use the dynamic value Prefix followed by -ClientID and -Secret.

Securing the Secret Value

The secret value should be kept secret. So the Action output needs securing. Click on the ellipse (3 dots) on the Get secret – Secret action. Turn on the toggle for Secure Outputs and then click Done at the bottom of the dialog.

This could be done on ClientID as well if required. Each action that has a security setting applied will show a padlock. When a flow run execution is looked at the value of the secret will not be available.

Returning the Values

The final part for this flow is to return the values. And for this flow to run as a child flow it must have a respond action. Click on add action and search for the Power Apps connector. It only one has one action Respond to a Power App or flow. Add three outputs to return TenantID, ClientID and Secret.

Handling the Connections

When an instant flow runs the connections are usually based on who clicked the start on the flow. This does not work for a child flow, so a connection must be selected that will be used for when it runs.

The changes need to be made from the flow details page, save and click the blue arrow in the top left to get there. Click on Edit in the Run only users box. When the pane appears, under connections used select a connection under Azure Key Vault. A message will appear to state users only get access in this flow, click OK to close it and then click Save to save the changes.

Testing the flow

When you first write a child flow I suggest you write an instant flow to test it. The Run a Child Flow action only is available if your flows are in a solution. In order to protect the secret value you also need to protect the outputs of the Run a Child flow action.

This tests that the flow runs a child flow and returns values even though we can’t see them.

Conclusion

We now have an app that can fetch secrets, we’ve secured the authentication details and now written a flow to securely retrieve those values. Next step is to make sure Power BI will allow us to do this.

Power BI Series

Create Azure Key Vault to store Tenant ID, Client ID and Secret

Sat, 06 Apr 2024 20:14:00 +0000

Azure Key Vault is a cloud service that provides a secure store for secrets. And in the previous post on creating Power BI Service Principal Profile we added a secret. The Tenant ID, Client ID and Secret values give access to the Service Principal and whatever permission they have. So for that reason we are going to create an Azure Key Vault.

This post is part of the Power Automate and Power BI Rest API series

Create Azure Key Vault

The first step is to create the Azure Key Vault. Start at https://portal.azure.com/. From the Home screen, navigate to all services and find Key Vaults. Once on the Key Vaults page click on Create to start the process. This will navigate you to a screen to select Subscription and Resource group. Key vaults do cost money, in my case

Add Role Assignment

Now we have create a new key vault to store our secrets the obvious place to go next is to Secrets. But if you take a look there you will see you do not have permission to play with secrets yet. And if you try to create one it will fail.

You do have the rights to give yourself permission. On the left hand side menu, click on Access Control (IAM). Click on +Add and from the drop down options select Add role assignment.

When the next screen appears, we need to select a role based on Secrets. In the search box enter Secret and from the list select Key Vault Secrets Officer, that can read and write secrets. Click next to move to the Members tab. Click on + Select members and select yourself from the list and anyone else that needs access. When all the members are listed, click Review + Assign twice.

You can look at the list of role assignments or click on Check my access for confirmation. If you want a user to be able to read the secrets but not write them you would pick Key Vault Reader.

Add Secrets

When we now head to Secrets on the left hand menu, there are no warnings about being unauthorized. Click on + Generate/Import to open the Create a secret form. Upload can stay as Manual, enter in a name and the value. For naming I will use a common start for the Client ID and Secret so that in the flow in the next post I only need to ask for one parameter.

I also add a secret to store the Tenant ID. This probably doesn’t need to be as secure but it makes it easy if everything is in the same location.

Conclusion

I now have a key vault with 3 values. I can now use either environment variables or a flow to pull through the values. I can add more secrets to the vault for other Power BI actions.

Azure on Hat Full of Data

Get Secret from Azure Key Vault in a Microsoft Fabric Notebook

Azure Key Vault Part

Python to Get Secret from Azure Key Vault

Reacted!

Conclusion

Use Power Automate to Fetch Secrets from Key Vault

Flow design

Setting up the Trigger

Adding Actions to Fetch Secrets

Securing the Secret Value

Returning the Values

Handling the Connections

Testing the flow

Conclusion

More Power Automate Posts

More Power BI Posts

Power BI Series

Create Azure Key Vault to store Tenant ID, Client ID and Secret

Create Azure Key Vault

Add Role Assignment

Add Secrets

Conclusion