vault-secret | Kubernetes controller and tool for creating k8s secret | Identity Management library

Update:
You should declare a variable first by click blank, then you can select a variable at step3:

After you added ADF managed identity permissions to Get and List secrets.

1. Add a secret to the key valut. Here my secret name is mysecret.
   

2. So your URL should looks like https://your-keyvault-name.vault.azure.net/secrets/mysecret?api-version=7.0
   

3. Add dynamic content @activity('Web1').output.value to your Set variable1 activity.
   

You can't execute this operation using the service principal - this is a limitation on the Azure side. The documentation says about this explicitly:

You need an Azure AD user token to create an Azure Key Vault-backed secret scope with the Databricks CLI. You cannot use an Azure Databricks personal access token or an Azure AD application token that belongs to a service principal.

P.S. It's a big pain point when automating the provisioning of workspaces, but because it's a problem in Azure, everything that you can do is to escalate to their support, maybe it will be prioritized.

P.P.S. have you looked onto Databricks Terraform Provider - it may make your life easier compared to Powershell + REST API

In your code using V12 SDK, for generate_blob_sas function, the param name should be permission instead of permissions

This is my test code based on the code you shared:

Two potential issues to check out here:

1. your app creation assigns the result to $fnApp. perhaps $fnApp or as commented above, $fnApp.ApplicationId is what you should be using for the -ServicePrincipalName parameter on the access policy grant.
2. you don't have privileges to assign RBAC roles. Go to the Key Vault, choose Access Control, then click the Role Assignments tab and verify that your user appears in the list as an Administrator, User Access Administrator, or Owner.

Edit: With respect to the RBAC privilege, since this is running in Azure Powershell from Azure DevOps, you need to check the role assignment for the Service Connection's service principal - under Azure Active Directory in the Azure Portal, look up the principal used to create the service connection, and make sure THAT gets the correct Role on the key vault.

My idea on your case is add judgement when creating 'CosmosClient'. And here's my code.

From azure-mgmt-storage==16.0.0, there is a list() method in the SkuOperations class. Since the method will return multiple skus for every region and storage kind available, you can use a set to remove duplicate SKU names.

From the error, it seems managed identity is not applied to your Function app correctly. You should be able to see that going to the identity blade of Function app.

Additionally, you should add the required access policy (separate from role assignment in access control) (secret get here) to allow the identity (same name as the app) to access keyvault if you are not using the new preview access control. Refer How to set and get secrets from Azure Key Vault with Azure Managed Identities and Python.

Using the Azure Portal, go to the Key Vault's access policies, and grant required access to the Key Vault.

1. Search for your Key Vault in “Search Resources dialog box” in Azure Portal.
2. Select "Overview", and click on Access policies
3. Click on "Add Access Policy", select required permissions.
4. Click on "Select Principal", add your account
5. Save the Access Policies

You can also create an Azure service principal either through Azure CLI, PowerShell or the portal and grant it the same access.

You can save the value like below using CLI:

It will be saved like you want:

The code is what I test in my side with a csv file in local. But I'm not sure if the line dict_reader = csv.DictReader(table) works in your side. You can do some test and modify the code by yourself if it show error.