Hi,
Very good material, congratulations.
I would like to suggest to include an Access Policy in the Key Vault for the subscription owner, otherwise it wouldn't be able to see the secret created during the provisioning.
https://github.com/Azure/Test-Drive-Azure-Synapse-with-a-1-click-POC/blob/main/nestedtemplates/keyvaultpermissionsupdate.json
Regards,
Tiago Moraes