Enabling Keyless Authentication - Workload Identity Federation for GCP from Microsoft data platform

Category: Feature Request / Security & Authentication

Impacted Services: Azure Data Factory (BigQuery Linked Service), Power BI (Desktop & Service), Microsoft Fabric (Lakehouse, Dataflows Gen2, Data Pipelines), Power Query Connectors

Executive Summary

Currently, Microsoft’s Google BigQuery integrations in Azure Data Factory (ADF), Power BI, and Microsoft Fabric rely exclusively on Service Account JSON Keys for machine workloads or interactive User OAuth / Single Sign-On for human users. There is no native support for Workload Identity Federation (WIF) between Microsoft Entra ID and Google Cloud Platform (GCP) for non-interactive machine workloads.

In enterprise environments—particularly where Google BigQuery endpoints are publicly accessible—forcing the use of static, long-lived JSON key files presents a severe credential leakage risk, increases management overhead, and violates zero-trust principles. We request Microsoft prioritize adding native Workload Identity Federation (Machine-to-Machine) support across ADF, Power BI Desktop/Service, and Microsoft Fabric (including Lakehouse).

Security & Risk Exposure Analysis

• 1. Data Exfiltration Risk via Public Endpoints: Many enterprise BigQuery instances rely on GCP’s public API endpoints, protected primarily by IAM authentication and network controls. Storing a service account key file creates a single point of failure: if a key with BigQuery Data Viewer or BigQuery Admin roles is leaked, an attacker can query or exfiltrate sensitive data from any public IP address without triggering perimeter network alerts.
• 2. High Credential Blast Radius: Unlike short-lived OIDC tokens (which expire within 1 hour), GCP Service Account JSON keys remain valid until explicitly revoked. If exposed via build logs, code repositories, unencrypted backups, or compromised storage, the exposure window lasts indefinitely.
• 3. Operational Overhead & Rotation Risk: Storing keys in Azure Key Vault mitigates storage risk but does not eliminate lifecycle risk. Automated rotation of GCP JSON keys across Key Vault, ADF, Lakehouse shortcuts, and Power BI datasets is fragile and regularly breaks automated data pipelines.

Proposed Solution: Universal Machine-to-Machine Federation

Establish a trust relationship between GCP Workload Identity Pools and Microsoft Entra ID (Azure AD), allowing Azure workloads to dynamically request short-lived, auto-rotating GCP access tokens via OIDC without ever generating or storing private keys.

Requested Functionality by Ecosystem:

• Azure Data Factory (ADF Linked Service):
• Add a new option under Authentication Type: Workload Identity Federation / Entra Managed Identity.
• Allow ADF runtime engines to pass System-Assigned or User-Assigned Managed Identity tokens to GCP’s Security Token Service (STS) to exchange them for temporary Google Service Account tokens.
• Power BI Ecosystem (Desktop & Service):
• Desktop: Enable Power Query connection dialogs to accept Entra Service Principal or Managed Identity authentication for BigQuery models.
• Service: Support Entra Managed Identity / Service Principal credentials under Data Source Credentials in workspace settings to ensure unattended, scheduled background dataset refreshes run without requiring active user sessions.
• Microsoft Fabric Ecosystem (Lakehouse, Dataflows Gen2, Data Pipelines):
• Support Entra Managed Identity / Service Principal credentials directly within Fabric Lakehouses when creating shortcuts or ingesting BigQuery tables.
• Ensure native Workload Identity Federation is built directly into Fabric Data Pipelines and Dataflows Gen2 to secure modern background ETL/ELT workloads.

Reference Documentation

• Power Query Google BigQuery Connector Docs: Microsoft Docs
• Azure Data Factory Google BigQuery Connector Docs: Microsoft Docs
• Google Cloud Workload Identity Federation Overview: GCP Docs
• Fabric - https://learn.microsoft.com/en-us/fabric/data-factory/connector-google-bigquery?source=recommendations

Business & Security Benefits

• Keyless Security Architecture: Completely eliminates long-lived service account key files and manual key rotation overhead across all data environments.
• Compliance Alignment: Enables enterprise compliance with SOC 2, ISO 27001, and Zero-Trust standards regarding identity management.
• Reduced Vulnerability Radius: Even if a public BigQuery endpoint is exposed, access relies exclusively on transient OIDC tokens tied strictly to the runtime identity of the ADF pipeline, Lakehouse job, or Power BI refresh engine.