Currently, Fabric Workspace Identity cannot be used to authenticate against custom APIs protected by Microsoft Entra ID.
Azure Managed Identities support requesting an access token for a specific API audience/resource, making it possible to securely call custom APIs without managing credentials. Fabric Workspace Identity appears to be limited to Fabric-integrated authentication scenarios.
Adding support for acquiring tokens for custom APIs would make Workspace Identity behave more like an Azure Managed Identity and reduce the need to use separate Service Principals with the Client Credentials flow for Fabric workloads.
Update (Sep 19th, 2026):
Showing example of what I'd like to do.
token = notebookutils.credentials.getToken("api://my-custom-api")
or
from azure.identity import FabricWorkspaceIdentityCredential
credential = FabricWorkspaceIdentityCredential()
token = credential.get_token("api://my-custom-api/.default")
Or even just let ManagedIdentityCredential work also for Workspace Identities.
