Workspace Identity support for arbitrary outbound Microsoft Graph API calls

Hi ,

No. Fabric Workspace Identity does not support arbitrary outbound Microsoft Graph API calls from a Spark notebook today.

Details

1. notebookutils.credentials.getToken() supports a fixed audience list only: pbi, storage, keyvault, and management (ARM). Graph is not on that list.
2. Workspace Identity is scoped to Fabric-managed integration surfaces: OneLake shortcuts, pipelines, semantic models, Dataflows Gen2, trusted-workspace access to firewall-protected storage, and Fabric Connections in notebooks (predefined connector types, no OAuth2.0).
3. Notebooks do not run under the Workspace Identity by default:
   • Interactive run: current user context
   • Pipeline activity: pipeline's last-modified user identity
4. Scheduler: identity of whoever created or updated the scheduleA Fabric Ideas request "Run notebook as Workspace Identity" is still Open. The community workaround is to convert the notebook to a Spark Job Definition, which runs under the Workspace Identity. Even so, getToken still won't return a Graph token.

   Alternatively try below approach

   Use an Entra app with the client credentials flow. Store the secret in Key Vault and pull it via notebookutils.

    

   Thank you!
   Proud to be a Super User!
   🏷️ Need more help?
   ✅ Don’t forget to Accept as Solution if this guidance worked for you.
   ❤️Your Like motivates me to keep helping