Impact of Azure Key Vault API 2026-02-01 and RBAC default on mssparkutils.credentials.getSecret in Microsoft Fabric

Question

Hi Microsoft Support,

We received notice about the retirement of Azure Key Vault APIs prior to 2026-02-01 and the move to Azure RBAC as the default access model.

We use Microsoft Fabric PySpark notebooks and retrieve secrets using: mssparkutils.credentials.getSecret.

Can you please confirm:

1. Whether this API change or RBAC default will impact mssparkutils.credentials.getSecret in Fabric.
2. Whether Fabric requires legacy access policies or fully supports Azure RBAC–only Key Vaults.
3. Any required role assignments or migration guidance to avoid secret access failures.

Thanks for the clarification.

Best regards,
Pawel

Answer 1

I think fabric’s getSecret keeps using the kv data‑plane, so the api cutoff doesn’t touch it. rbac‑only vaults work fine… just give the workspace identity Key Vault Secrets User at the vault scope. that’s all u need to avoid failures, no legacy access policy required.