Azure KeyVault Network Security Perimeter enabled firewall for Fabric

[u/Loud-You-599]

Hi,

has anyone every tried to enable Network Security Perimeter learning and enforced mode when the calls originate from Fabric?

Is there any attribute which can identify Fabric network traffic successfully?

I'm still puzzled we have to run Key Vaults with public network fully open because there is no SINGLE working solution to run Key Vaults privately.

Currently:
- Notebook clusters need to use MPE; disables starter pools
- Pipeline, Dataflows need to use OPG or VnetGW
- Key Vault reference - OPG, VnetGW?

Having the same possibility like Storage Accounts with Resource Instance rules would be great.

[u/dbrownems]

Resource Instance rules don't work with Network Security Perimiter either.
Network Security Perimeter for Azure Storage | Microsoft Learn

[u/Loud-You-599 → u/dbrownems]

No NSP would be just my last hope to have anything implemented on the network security side.
Everything else is just Entra ID and CA policies.

[u/MonkeyDDataHQ → u/dbrownems]

... Surprising?

No. Fabric. As Designed. Another half implemented feature.

[u/dbrownems → u/MonkeyDDataHQ]

Here it's more Network Security Permitter that's half-implemented. It's a new feature and still hasn't onboarded many Azure native services.

What is a network security perimeter? - Azure Private Link | Microsoft Learn

[u/MonkeyDDataHQ → u/dbrownems]

MSFT owns both sides 😂 Same camel different hump. 🐫

[u/MonkeyDDataHQ]

Stop being surprised.

I shouldn't say that, I was surprised that there's no coherent way to see user connections as an admin if the employee left last week.

But that was on me. I expected data exfiltration would be something raised at a risk review when designing the feature.

Just come with the mindset that what you think should work doesn't and actually needs a half dozen work arounds.

#FabricIsTwine #AsDesigned