Data factory - Azure Key Vault (Preview) Activity - bug?

Hi @Oliver Mills
Thanks for the additional context. I can see why hardcoding Key Vault URLs throughout pipelines becomes difficult to manage across environments.

Rather than relying on a preview activity, a more common approach is to parameterize the Key Vault base URL (or vault name) and supply environment-specific values during deployment. In Azure Data Factory CI/CD scenarios, this can be done using ARM template parameters, global parameters, or deployment pipeline variables so that the same pipeline code can target different Key Vaults in Dev, Test, and Production without requiring manual updates.

If you're currently using Web activities to retrieve secrets, can you share how the Key Vault URL is defined today (hardcoded in the activity, pipeline parameter, global parameter, etc.)? That will help determine the most maintainable approach for your deployment process.

For reference: https://learn.microsoft.com/azure/data-factory/continuous-integration-delivery https://learn.microsoft.com/azure/data-factory/author-global-parameters

Hello Oliver !

Thank you for posting on MS Learn Q&A.

This looks like a preview bug not a usable activity configuration screen.

I think it looks like a developer placeholder that accidentally shipped in the ADF authoring UI. I would not rely on this Azure Key Vault Activity for production until Microsoft documents it or the Settings tab exposes real properties.

For now, you can store credentials in Key Vault and referencing them from linked services.

https://learn.microsoft.com/en-us/azure/data-factory/store-credentials-in-key-vault

Or you can use a Web Activity to read a secret during a pipeline run where you call the Key Vault secret URI using a Web activity with Managed Identity authentication : GET <secret-uri>?api-version=7.5, authentication = managed identity, resource = https://vault.azure.net and enable Secure Output.

The factory managed identity needs Key Vault secret permissions such as Get and usually List, either through access policies or IAM role assignment such as Key Vault Secrets User.