Azure Databricks create secret scope fails when policy is there that disables public access

Question

In Azure Databricks we try to create a secret scope from our devops pipeline into a keyvault that is connected by private endpoint.

We setup the exception "Allow trusted Microsoft services to bypass this firewall".

But when the policy is assigned that disables public access for keyvaults, the secret scope cannot be created. When we exempt this resource, the secret scope creation works, after this we can delete the exemptions. Is this normal behaviour?

Kind regards,
Jamie

Answer 1

Hello @Jamie G,

Welcome to the MS Q&A platform.

My understanding is that if you properly configure the private endpoint to the key vault and connect to the virtual network that your Azure Databricks workspace is connected to, then you shouldn't see any error.

Can you please check the below?

1. Check if the Key Vault is accessible from within the virtual network using Azure PowerShell?
2. If you have already created the private endpoint connected to the virtual network, you can try updating the policy to allow access to the private endpoint. You can create a new policy that allows access to the private endpoint and assign it to the Key Vault. This will allow the Azure Databricks workspace to access the Key Vault via the private endpoint.