You have an Azure Databricks workspace.

The solution is a Key Vault-backed secret scope combined with dbutils.secrets.get() in the notebook.

An Azure Key Vault-backed secret scope does not copy the secret value into Databricks. Every call to dbutils.secrets.get() fetches the live current value directly from Key Vault at runtime. This means when the cloud security team rotates storageKey in Key Vault, the notebook automatically picks up the new value on its next run — no Databricks configuration changes needed. That satisfies ' always retrieve the latest value. '

The principle of least privilege is upheld because only the secret scope has read access to Key Vault through a service principal or managed identity, and individual users never see the raw secret value — Databricks redacts it in logs automatically.

A Databricks-backed scope stores a copy of the secret inside Databricks, so it wouldn ' t automatically reflect Key Vault updates. Hardcoding or using environment variables would expose the secret in plain text.