How do we read a secret value in ADF using Lookup Activity or any other activity

Question

How do we read a secret value in ADF using Lookup Activity or any other activity

Immaneni, Nanda 25

Smaran Thoomu 24,185 Reputation points Microsoft External Staff Moderator

2025-06-24T09:53:19.14+00:00

@Immaneni, Nanda Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Smaran Thoomu 24,185 Reputation points Microsoft External Staff Moderator

2025-06-26T06:32:04.62+00:00

@Immaneni, Nanda Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

Your answer

Smaran Thoomu 24,185 Reputation points Microsoft External Staff Moderator

2025-06-24T09:53:19.14+00:00

@Immaneni, Nanda Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Smaran Thoomu 24,185 Reputation points Microsoft External Staff Moderator

2025-06-26T06:32:04.62+00:00

@Immaneni, Nanda Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Nandan Hegde 36,151 MVP Volunteer Moderator

Do you mean secret value from Azure Key vault? If yes, it is possible to get via web activity leveraging the key vault REST API https://medium.com/@fmilano/azure-data-factory-retrieve-key-vault-secrets-in-your-pipelines-at-runtime-1ff105c0fb76

Immaneni, Nanda 25 Reputation points

2025-06-20T04:24:43.1+00:00

The problem with is approach is the URL is specific to the environment.

Example: https://<env>.vault.azure.net/secrets/<secretName>/<secretVersion>

Here env can change like dev, uat, prod etc..

Here secretName is same across different Key Vaults.

Here secretVersion can be anything like 91c98fd54d4a4ba4b15a6d41ad4aff16 etc.. and this can change based on environment.

So this approach cannot be used, as code is common across environments.

We need an Approach where we have a Linked Service connecting to the Key Vault, and this linked service name is same across environments, underlying secretName is also same, however the secretVersion may differ.
Nandan Hegde 36,151 Reputation points MVP Volunteer Moderator

2025-06-20T05:03:54.9666667+00:00

you can parameterize the URL and use a config table to fetch the values based on environments at runtime and accordingly leverage the REST API.

In this way the code would be common but values would change at runtime during execution based on the ADF name (as ADF name would be diff across environments)
Venkat Reddy Navari 3,060 Reputation points Microsoft External Staff Moderator

2025-06-20T06:06:11.5633333+00:00
Hi Immaneni, Nanda

I wanted to correct part of my earlier response based on what @Nandan Hegde rightly pointed out.

The @AzureKeyVault() function only works inside linked services — for example, when you're using it to securely pass a password to Azure SQL or Blob Storage. It doesn’t work inside activities like Lookup, Set Variable, or queries — which is why you're getting the error:

'AzureKeyVault' is not a recognized function

What you should do instead:

To use a secret value inside an activity (like Lookup), the supported way is:

Use a Web activity to call the Azure Key Vault REST API

Pass in the Key Vault and secret name as parameters

Capture the value and use it in your pipeline

This works across all environments and avoids hardcoding URLs or secret versions.

If this clears things up, we would really appreciate it if you could revise your feedback based on this clarification. It helps promote helpful answers and improves guidance for others in the community.

Let us know if you need help implementing the REST API call or any further clarification.

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Nandan Hegde 36,151 Reputation points MVP Volunteer Moderator

2025-06-20T06:09:53.4366667+00:00

The Key vault linked service can only be used for integration with other linked services and in case if you need a secret value for any further use cases within the ADF pipelines, that wont work. So you would need to leverage the REST API
Immaneni, Nanda 25 Reputation points

2025-06-20T20:14:11.6566667+00:00

@Venkat Reddy Navari , Thanks for your suggestions.

I tried using a Lookup Activity and in that selected Query as:

@AzureKeyVault(LS_KeyVault, 'MySecretName')

I get message saying 'AzureKeyVault' is not a recognized function

Then I included the Query as:

select @AzureKeyVault(LS_KeyVault, 'MySecretName')

This also is failing.
Immaneni, Nanda 25 Reputation points

2025-06-20T20:19:07.0666667+00:00

I created a Lookup Activity and then tried putting Query as follows:

@AzureKeyVault('LS_KeyVault', 'MySecretName')

Got error saying: AzureKeyVault is not a recognized function.

Then I tried with :

select @AzureKeyVault('LS_KeyVault', 'MySecretName')

Still did not work
Nandan Hegde 36,151 Reputation points MVP Volunteer Moderator

2025-06-21T03:22:13.2466667+00:00

based on my understanding, web activity is the only way as even stated by MSFT docs:

https://learn.microsoft.com/en-us/azure/data-factory/how-to-use-azure-key-vault-secrets-pipeline-activities

And it is not possible to reference the Key vault secret from linked service within any other activities and only within other linked services
Smaran Thoomu 24,185 Reputation points Microsoft External Staff Moderator

2025-06-23T01:49:50.81+00:00
Hi Immaneni, Nanda

As Nandan Hegde mentioned, it is true that Azure Data Factory natively supports Azure Key Vault integration through linked services - this is the recommended way to securely inject secrets (e.g., passwords) into other linked services like Azure SQL DB, Azure Blob, etc.

However, it is important to note that:

@AzureKeyVault() is not supported within pipeline expressions like Lookup queries, Set Variable, or any activity parameters.

That’s why you're seeing the error: 'AzureKeyVault' is not a recognized function -this is expected, because ADF does not allow secret resolution at the activity level using that expression.

Supported Method for Activity-Level Use:

To use secrets within pipeline logic (outside of linked services), the supported pattern is:

Use a Web activity to call the Key Vault REST API

Pass the Key Vault name and secret name dynamically using parameters (to support multiple environments)

Capture the secret value in a variable using Set Variable, if needed downstream

We would really appreciate it if you could resubmit or revise your feedback based on this improved solution. Your updated rating helps ensure high-quality answers are promoted across the community.

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

How do we read a secret value in ADF using Lookup Activity or any other activity

1 answer

Your answer