能否为Data Factory V1配置使用Key Vault？

Hey Adam, totally get why you're stuck on this—Data Factory V1 doesn't have the native Key Vault integration that V2 offers, but there are still reliable workarounds to keep your credentials secure. Let me walk you through the two most practical methods:

方法1：通过Azure Automation Runbooks同步密钥 #

This is a solid approach if you need to inject Key Vault secrets into your Data Factory V1 linked services:

• First, store all your sensitive credentials (like database passwords, API keys) in Key Vault, and grant your Azure Automation account the Get permission via Key Vault's access policies.
• Write a PowerShell Runbook that uses the Get-AzKeyVaultSecret cmdlet to pull the latest secret, then uses Data Factory V1's PowerShell cmdlets (or REST API) to update the linked service's credentials.
• You can set this Runbook to run on a schedule, or trigger it right before your Data Factory pipeline runs to ensure your credentials are always up-to-date and secured outside of DF V1.

方法2：在自定义活动中直接调用Key Vault API #

If you need to use secrets dynamically during pipeline execution, this method works well:

• Build a custom activity in DF V1 using C# code. In this activity, authenticate to Azure AD (using a service principal that has Get access to Key Vault) and call the Key Vault REST API to fetch the secret you need.
• Once you have the secret, you can use it directly in the custom activity to connect to your data source, or pass it along to other activities in the pipeline.

重要提醒 #

• No matter which method you choose, stick to the principle of least privilege when setting up permissions—only grant the exact access needed to the service principals/automation accounts.
• Keep in mind that Data Factory V1 is a legacy service with no new feature updates from Microsoft. For long-term security and ease of use, migrating to Data Factory V2 is the best move, as it has native, out-of-the-box Key Vault integration.

内容的提问来源于stack exchange，提问作者Adam