Azure PowerShell Set-AzKeyVaultAccessPolicy command setting access policy to data factory

Question

While trying to give access policy (Azure key vault) to my Azure data factory through PowerShell, I am getting error below:

Set-AzKeyVaultAccessPolicy : Operation returned an invalid status code 'BadRequest' At line:64 char:1
Set-AzKeyVaultAccessPolicy -VaultName $keyvaultname -ServicePrincipal ...
  + CategoryInfo          : CloseError: (:) [Set-AzKeyVaultAccessPolicy], Gr     aphErrorException
  + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.SetAzureKeyVau     ltAccessPolicy

Any help would be really appreciated. Thanks in advance.

This is the script I am trying to execute:

## select subcription

$subcription='Visual Studio Enterprise – MPN'

Select-AzSubscription $subcription


## create a new resource group

$resourcegroupname=”gho-rg-dev”
$location="eastus"

$rg=New-AzResourceGroup `
        -Name $resourcegroupname `
        -Location $location


## create the storage account


$storageAccountName = "ghostoragelab"
$skuName = "Standard_LRS"

$storageAccount = New-AzStorageAccount -ResourceGroupName $resourcegroupname `
                     -Name $storageAccountName `
                     -Location $location `
                     -SkuName $skuName

$storageaccountkey=(Get-AzStorageAccountkey -ResourceGroupName $resourcegroupname -Name $storageAccount.StorageAccountName).Value[0]


##create azure data factory

$datafactoryname='lab-factory-dev'

$df= New-AzDataFactoryV2 `
        -ResourceGroupName $resourcegroupname -Name $datafactoryname -Location $location




## creating the azure key vault

$keyvaultname="labkeydev"

$keyvault=New-AzKeyVault -ResourceGroupName $resourcegroupname -Name $keyvaultname `
        -Location $location

# creating the secret key in keyvault

Set-AzKeyVaultSecret -VaultName $keyvaultname -Name "secret-access-key"`
 -SecretValue(ConvertTo-SecureString -String $storageaccountkey -AsPlainText -Force)

#Give access policy to the datafactory thorugh keyvault

*## this is where script is failing*

Set-AzKeyVaultAccessPolicy -VaultName $keyvaultname -ServicePrincipalName $df.DataFactoryId -PermissionsToSecrets Get

Added the script that i was trying to execute through powershell — Ghouse thanedar

Joy Wang-MSFT Joy Wang-MSFT · Accepted Answer · 2020-03-13T08:42:30

I suppose you want to add the MSI (Managed Service Identity) of the Data Factory to the Access policies of your keyvault.

You got the error because you used the -ServicePrincipalName $df.DataFactoryId in this command Set-AzKeyVaultAccessPolicy, the $df.DataFactoryId is the resource id of the data factory, what you need is the Application ID(Client ID) of the MSI.

So if you want to use -ServicePrincipalName parameter, your command should be:

$appId = (Get-AzADServicePrincipal -ObjectId $df.Identity.PrincipalId).ApplicationId
Set-AzKeyVaultAccessPolicy -VaultName joykeyvault -ServicePrincipalName $appId -PermissionsToSecrets get

The command above needs the permission to get service principal in your Azure AD. If you don't have this permission, you could use the command (I recommend you to use this one):

Set-AzKeyVaultAccessPolicy -VaultName joykeyvault -ObjectId $df.Identity.PrincipalId -PermissionsToSecrets get -BypassObjectIdValidation

If your data factory has already been created, you could use Get-AzDataFactoryV2 to get it, then add it to the access policies.

$datafactory = Get-AzDataFactoryV2 -ResourceGroupName <group name> -Name <factory name>
Set-AzKeyVaultAccessPolicy -VaultName joykeyvault -ObjectId $datafactory.Identity.PrincipalId -PermissionsToSecrets get -BypassObjectIdValidation

Azure PowerShell Set-AzKeyVaultAccessPolicy command setting access policy to data factory

1 Answers