Pure Python Notebook: authenticate to Azure DevOps Artifacts using Fabric Workspace Identity

Hi llueg​,

I think you have found a real gap between the current pure Python notebook experience and the newer Workspace Identity support for Azure Artifacts.

As far as the current documentation goes, I don't see a supported way for a pure Python notebook to directly request an Azure DevOps/Azure Artifacts access token from its Workspace Identity and pass that token to pip.

The reason is that NotebookUtils credential token acquisition currently documents only storage, pbi, keyvault and kusto as supported token audiences. Azure DevOps isn't exposed as a documented audience, so I wouldn't rely on passing an Azure DevOps resource ID to getToken() as an undocumented workaround.

There is, however, a newer PAT-less path that gets very close to what you want. Fabric now supports authenticating an Azure Artifact Feed connection with the Workspace Identity. The Workspace Identity can be added to the Azure DevOps feed with at least Feed Reader, and Fabric then uses that authenticated connection when resolving packages in a Fabric Environment.

Microsoft documents that flow under library management for Fabric Environments.

The limitation for your scenario is that the current pure Python notebook documentation explicitly lists Environment integration as unavailable for Python notebooks. That Workspace Identity → Azure Artifacts flow therefore currently helps Spark notebooks using Fabric Environments, but it doesn't give a pure Python notebook a token that can be handed directly to pip install --index-url.

There is also the newer Fabric Connection integration for notebooks, which supports Workspace Identity authentication and is currently in Preview, but I haven't found Microsoft documentation showing an Azure Artifact Feed connection credential being exposed for direct pip authentication in a pure Python notebook.

So at the moment I would describe it as:

• Spark notebook + Fabric Environment: Workspace Identity → Azure Artifacts is supported.
• Pure Python notebook + direct pip install: I don't see a documented Workspace Identity-based Azure DevOps token flow yet.

For pure Python, your Key Vault-backed PAT remains the documented practical option unless Microsoft extends the Environment/Azure Artifact Feed integration to the Python kernel or exposes Azure DevOps as a supported notebook credential audience.

AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.