Hi and thank you both for your replies. I checked some of this out and probably its possible, but i have found another way. Puting this out there if somone in the future needs to solve similar.
Option 1 [best i found and will be using]: Creating a new user and it's own onedrive + refresh token to obtain access with graph API:
* Created a specific user for my flow. "XXXXX@myCompanyName.com"
* Use this users onedrive to land files. Do not give it access to anything else.
* Register an app in azure, and give the registred app delegated files rreadwrite access + admin consent, (so app can't access everyones folders, only user that is authenticated)
* Use manual flow to obtain a refresh token. (app.initiate_device_flow)
* Save the refresh token to a key vault. This can now be used to retrieven an access token when running notebook.
* Use acquire_token_by_refresh_token method to get new access token and new refresh token. Update the existing key vault programtically once retrieved so you always have a new refresh token.
* Do whatever you need to do in the API, like this case, save files to a one drive folder from lakehouse.
https://learn.microsoft.com/en-us/python/api/msal/msal.application.publicclientapplication?view=msal...
Option 2: Set up a notebook and follow the "Get access without user"
https://learn.microsoft.com/en-us/graph/auth-v2-service?tabs=http
By giving the registred app .readwrite.all permission on "Application permissions" (Not delegated), and granting it admin consent, it could read and write to onedrive. However, this means that one could access all folders for all users on tenant which I found to be a bad option.
Option 3:
* Creae a specific user for your need flow. "XXXXX@myCompanyName.com" and restrict its one drive access.
* Give the registred app delegated readwrite access + admin consent, (so app can't access everyones folders, only user that is authenticated)
* Used the (not very recommended) https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth-ropc flow to authenticate
* Put password in keyvault for some added security.
Now the notebook can run from fabric, read files from lakehouse and insert into the onedrive folder. I found option one to be most secure.
