Not able to access the ADLS storage account via Microsoft Purview scanning

Hi GS, ANEESHKUMAR,

Thanks for your question on the Microsoft Q&A portal!

As you are trying to scan an Azure Data Lake Storage (ADLS) account using Microsoft Purview. You created a Service Principal (SPN) and stored its credentials in an Azure Key Vault named "abcd". However, when Purview attempts to access the secret from the Key Vault, it fails with a 403 Forbidden error:

Unable to access secret name: xyz. Grant Purview MSI access to Azure Key Vault: abcd

This means that Purview's Managed Identity (MSI) does not have sufficient permissions to read the secret from the Key Vault.

Even though you assigned the Key Vault Secrets User role to Purview MSI using RBAC, this alone might not be sufficient. You also need to ensure the following:

• If your Key Vault uses Access Policies, Purview MSI must have explicit Get and List permissions on secrets in the Access Policies.
• If your Key Vault uses RBAC, assign the Key Vault Secrets User role on the Key Vault to Purview MSI at the appropriate scope.
• The Key Vault firewall allows access from Purview MSI or the Self-Hosted Integration Runtime (SHIR) IP address and enable the setting to allow trusted Microsoft services to bypass the firewall.
• The secret name "xyz" referenced in Purview exactly matches the secret name stored in Key Vault (secret names are case-sensitive).
• If specifying a secret version, confirm it is correct; if unsure, omit the version to use the latest secret version.

Steps to Fix the Issue:

Step 1: Verify Key Vault Access Configuration

• If using RBAC model:
• Assign Purview MSI the Key Vault Secrets User role on the Key Vault resource.
• If using Access Policies model:
• Go to Azure Portal → Key Vault "abcd" → Access Policies
• Add a policy granting Purview MSI Get and List permissions on secrets.

Reference: https://free.blessedness.top/en-us/azure/key-vault/general/security-features#access-control

Step 2: Check Key Vault Firewall Settings

• Go to Azure Portal → Key Vault "abcd" → Networking
• If public network access is disabled, ensure you:
• Enable Allow trusted Microsoft services to bypass this firewall (includes Purview MSI)
• Add SHIR IP addresses if applicable

Reference: https://free.blessedness.top/en-us/azure/key-vault/general/network-security

Step 3: Validate Secret Name and Version

• Validate the secret name "xyz" exists in Key Vault and matches exactly.
• Confirm the secret is enabled and accessible.
• If you use a specific secret version, verify its correctness.
• If unsure, omit the version to always use the latest secret version.

Reference:

https://free.blessedness.top/en-us/azure/key-vault/secrets/quick-create-portal

https://free.blessedness.top/en-us/azure/key-vault/general/about-keys-secrets-certificates

Step 4: Revalidate the Credential Configuration in Purview

• Go to Microsoft Purview → Data Map → Credentials
• Edit the credential to ensure it references the correct Key Vault and secret name
• Test the connection again after saving changes

Reference:https://free.blessedness.top/en-us/purview/troubleshoot-connections

I hope this resolves your issue.

Thanks!

Hi GS, ANEESHKUMAR,

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this. 

Thanks!

Hi GS, ANEESHKUMAR,

Thanks for your follow up question

It is possible to configure access to Azure Key Vault through your Palo Alto Firewall without relying on the “Allow trusted Microsoft services to bypass this firewall” setting. This approach involves explicitly permitting outbound traffic from the Self-Hosted Integration Runtime (SHIR) IP addresses and the Microsoft Purview Managed Identity (MSI) to reach the Key Vault and other required Azure endpoints.

Here are the key steps to achieve this:

• Allow outbound traffic through Palo Alto Firewall: Configure your Palo Alto Firewall rules to allow communication on port 443 (HTTPS) to the Azure Key Vault endpoint (<yourkeyvault>.vault.azure.net) and other relevant Azure service endpoints.
• Allow SHIR IP addresses: Since you are using SHIR for scanning, include the IP addresses of your SHIR in your firewall allowlist so that it can connect to the Key Vault and storage account.
• Avoid enabling Trusted Microsoft services bypass: Disabling the "Allow trusted Microsoft services to bypass this firewall" option enhances security by preventing unrestricted Microsoft service access. Instead, rely on precise firewall rules as above.
• Validate DNS resolution and network routes: Ensure that firewall configuration does not block DNS resolution or routing to Azure service endpoints.

For more detailed guidance, consider reviewing the Azure Key Vault networking documentation section on firewall settings and trusted services, and Microsoft Purview data scan credential requirements:

https://free.blessedness.top/en-us/azure/key-vault/general/network-security

https://free.blessedness.top/en-us/purview/data-map-data-scan-credentials

This approach provides tighter control of network traffic through your Palo Alto Firewall while allowing necessary access for Microsoft Purview scanning operations.

Hope this clear the issue.

Thanks,

Pranitha

Hi GS, ANEESHKUMAR,

Just checking to see if you have a chance to check my previous response and helped, do let me know if you have any further questions on this. 

Thanks!