Reading Azure Key Vault secrets from inside Databricks

Azure Databricks integrates with Azure Key Vault by letting you create a Key Vault-backed secret scope, so secrets remain centrally managed in Key Vault while being referenced securely in notebooks, jobs, and cluster configurations. This avoids hardcoding credentials such as storage account keys, service principal secrets, or database passwords in code. Access to secrets is still controlled by Key Vault's own access policies and Databricks secret scope permissions.

1 · Learn the must-know

• 1A Key Vault-backed secret scope is created via the Databricks CLI or REST API using the Key Vault's DNS name and resource ID, not through the standard 'Create Secret' UI which only supports Databricks-backed scopes.
• 2Secrets are never actually stored in Databricks for Key Vault-backed scopes; Databricks only stores a reference and retrieves values from Key Vault at runtime.
• 3Retrieve secret values in code using dbutils.secrets.get(scope="<scope-name>", key="<secret-key>"), which works identically whether the scope is Databricks-backed or Key Vault-backed.
• 4Access control (ACLs) on a Key Vault-backed scope in Databricks are managed at the scope level, but the underlying secret access is ultimately governed by Azure Key Vault access policies or Azure RBAC on the vault itself.
• 5Secret values are automatically redacted from notebook output (displayed as [REDACTED]) when accessed via dbutils.secrets.get to prevent accidental exposure in logs or results.
• 6Creating a Key Vault-backed scope requires Contributor or higher access to the Key Vault resource so Databricks can validate and register the vault's URI and resource ID.

2 · Check your understanding