Forum Discussion
Pure Python Notebook: authenticate to Azure DevOps Artifacts using Fabric Workspace Identity
Can a Pure Python Fabric notebook running under a Workspace Identity obtain an Azure DevOps access token so that `pip install --index-url ...` can authenticate without a PAT?
It would be very nice if we could use the Workspace Identity to authenticate directly against a DevOps Feed in order to pull dependencies, as that would allow DevOps to directly target Feed-permissions for that Workspace (in particular, `Feed Reader`). For Spark Notebooks, we can use a Connection to do that, but for Pure Python Notebooks I can't find a documented way.
At the end of the day, one needs a token to pass to `pip` in order to bootstrap the notebook's runtime environment from the Feed, but as far as I can see there is no documented way to generate that token from the Workspace Identity. Currently, I'm using a keyvault'ed PAT. However, while this is fine-ish on the Fabric-side, it requires a dedicated Identity on the DevOps side, which I'd like to avoid.
2 Replies
- Kagiyama_yutaka
Continued Contributor
Python notebook in Fabric has no step that turns its Workspace Identity into an Azure DevOps / Azure Artifacts token for pip install --index-url, and the simple path is reading a PAT from Azure Key Vault and giving that value to pip.
The token API only gives audiences like storage, pbi, keyvault, and kusto, and Python notebooks do not take part in the Environment flow that Spark uses for Azure Artifacts. The Python kernel has no credential provider capable of producing an Azure DevOps audience token. This is a structural limitation of the current Python kernel architecture, not a missing feature in the documentation.
- ShivekMaharaj
Memorable Member
Hi llueg,
I think you have found a real gap between the current pure Python notebook experience and the newer Workspace Identity support for Azure Artifacts.
As far as the current documentation goes, I don't see a supported way for a pure Python notebook to directly request an Azure DevOps/Azure Artifacts access token from its Workspace Identity and pass that token to pip.
The reason is that NotebookUtils credential token acquisition currently documents only storage, pbi, keyvault and kusto as supported token audiences. Azure DevOps isn't exposed as a documented audience, so I wouldn't rely on passing an Azure DevOps resource ID to getToken() as an undocumented workaround.
There is, however, a newer PAT-less path that gets very close to what you want. Fabric now supports authenticating an Azure Artifact Feed connection with the Workspace Identity. The Workspace Identity can be added to the Azure DevOps feed with at least Feed Reader, and Fabric then uses that authenticated connection when resolving packages in a Fabric Environment.
Microsoft documents that flow under library management for Fabric Environments.
The limitation for your scenario is that the current pure Python notebook documentation explicitly lists Environment integration as unavailable for Python notebooks. That Workspace Identity → Azure Artifacts flow therefore currently helps Spark notebooks using Fabric Environments, but it doesn't give a pure Python notebook a token that can be handed directly to pip install --index-url.
There is also the newer Fabric Connection integration for notebooks, which supports Workspace Identity authentication and is currently in Preview, but I haven't found Microsoft documentation showing an Azure Artifact Feed connection credential being exposed for direct pip authentication in a pure Python notebook.
So at the moment I would describe it as:
- Spark notebook + Fabric Environment: Workspace Identity → Azure Artifacts is supported.
- Pure Python notebook + direct pip install: I don't see a documented Workspace Identity-based Azure DevOps token flow yet.
For pure Python, your Key Vault-backed PAT remains the documented practical option unless Microsoft extends the Environment/Azure Artifact Feed integration to the Python kernel or exposes Azure DevOps as a supported notebook credential audience.AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.
