Secret Stores

Secret Stores are configured per Domain. There is no separate organization or User Settings page for registering Secret Stores.

Choose Local File, Azure Key Vault, or Internal independently of the Data Platform. For example, Fabric can use Internal or Local File, and DuckDB can use Azure Key Vault. Optional connection reuse depends on compatible credentials; it does not restrict which Secret Store you can choose.

How to choose a Secret Store for a new Domain

1. Open Domains from the global application rail.
2. Select Add Domain.
3. Complete Basics, including Repository, and Data Platform, including Workspace. On Secret Store, keep Local File or choose Azure Key Vault or Internal.
4. For Azure Key Vault, complete Authentication. User connection and service identity are independent choices; Reuse Data Platform connection appears only when the corresponding requirement is compatible. Dedicated identity alone requires separate Client ID and Client secret. Ambient mode uses the host Azure identity and requires Azure tenant ID instead.
5. For Azure Key Vault, select Continue to vault. Choose a discovered vault or explicitly commit a supported canonical Resource ID through the same editable dropdown. Studio derives the read-only Vault URL. Reopen Authentication through its header without losing compatible draft values. Internal and Local File skip this step.
6. Confirm the safe Domain summary, then select Create Domain. Studio opens General and reconciles applicable saved service and resource readiness after saving.

Local File requires no configuration in this form. Secrets are supplied outside Studio; Studio does not create or edit that file.

Internal also requires no external identity or resource. After saving the Domain, use Secrets to manage its Internal inventory. Your Agent can discover active secret names in the selected Domain without receiving their values. Archived names are excluded; a listed name may still need a value before it can be used.

Use the vault dropdown's filter to find a vault by any case-insensitive part of its displayed name. Filtering does not alter the saved vault selection, and deleting the filter restores the discovered options. No matching options is different from discovery returning no vaults, still loading, failing, or reporting a truncated result.

How to change a Domain's Secret Store

1. Open Domains and select the Domain.
2. Open Resources, then expand Secret Store.
3. Under Secret Store Type, choose Local File, Azure Key Vault, or Internal and complete any displayed resource and identity fields.
4. Select Save changes. Studio does not copy secret values when the Secret Store changes.
5. Select Reconcile after saving when you want to refresh the saved service-readiness result.

Selecting Internal in an unsaved draft shows Save changes to enable the Secrets tab. The tab appears after saving, if you have permission to read secret metadata. Switching away hides Secrets but retains the Internal inventory and every version. Switching back restores access; no values are migrated or deleted.

How to manage Internal secrets

1. Open the Domain's Secrets tab.
2. Select Add secret. Enter Secret name using letters, numbers, or hyphens (1–127 characters). Names are case-insensitive.
3. Enter Secret value. Multiline and empty values are allowed, up to 25 KiB in UTF-8. Saved values cannot be viewed, revealed, or copied from this screen.
4. Set Enabled, Not before (optional), and Expires (optional) as needed. Dates use the local timezone shown in the form. Leave a date blank for no restriction.
5. Select Add secret. The inventory shows its status and version count.

An imported name with no value shows Needs value. Select Set value to configure its first value.

How to see versions and edit properties

1. Select Manage on a secret to open Versions. The table identifies the Latest version and shows each version's creation date, Enabled state, and date restrictions.
2. Select Add version, enter the new Secret value, then select Save new version. Saving a value creates another version; it does not replace the history.
3. To change a version without changing its value, select that row's Edit properties. Update Enabled or the date restrictions, then select Save properties. Clearing an existing date removes that restriction without adding a version.

How to archive, restore, or delete a secret

1. Select Archive, then confirm Archive. All versions and properties are retained.
2. Select Archived to find it. Use Manage to inspect its retained versions, or select Unarchive and confirm to restore it.
3. To remove an archived secret and every version irreversibly, select Delete permanently and review the confirmation. Cancel leaves it unchanged.

What you'll see

• An empty Active inventory says No active secrets. Add a secret to get started.
• Search secrets filters loaded records. Partial counts include a plus sign; use Load more to search the remaining records or see more versions.
• Refresh reloads metadata. Failed reads offer Retry and disclose that loaded records may be incomplete or stale; a failed read is not an empty inventory.
• A failed save retains your draft. After a conflicting change, select Refresh metadata for review, review the displayed metadata, then select I reviewed the refreshed metadata before saving again.
• Leaving a changed form asks Discard unsaved changes? Use Keep editing to retain the draft, or Discard changes to leave without saving.
• Secret-management permissions are separate from permission to edit Domain settings. Read-only access disables mutations. Domain lifecycle restrictions can also prevent changes; an archived Domain's metadata may be unavailable.

How to manage your connection

Open User Settings → Connections. Azure Key Vault requirements appear with a Secret Store badge. Select Connect or Reconnect to authorize the required identity, or Disconnect to remove the stored credential after reviewing every affected Domain and requirement.

Local File, Internal, and ambient identities do not create connection rows. A reused credential appears once with both Data Platform and Secret Store badges.

Quick reference

Control	What it does
Secret Store Type	Chooses Local File, Azure Key Vault, or Internal for one Domain, independently of its Data Platform.
Secrets	Manages the saved Internal inventory; does not manage Local File or Azure Key Vault values.
Manage	Opens retained versions and their properties without retrieving saved values.
Reconcile	Re-checks Domain-wide provisioning, both saved service identities, and your own User identity, live, for every non-terminal Domain lifecycle state (not offered while locked, archiving, or archived).
Connections	Manages personal credentials required by Domain Data Platform and Secret Store requirements.

Related

• Domains
• Connections