Programmatically add a user to the SharePoint UIL from Fabric after ACS retirement?

Sounds interesting/promising !

As for the steps ahead, would you happen to have more detailed step-by-step guide to how to:
- generate a credential in Azure
- be able to use it in a Fabric Notebook to generate/acquire a token that would allow us to call the `_api/web/ensureuser` with a successfull outcome

As for some additional context here are ...

... a printscreen of the Azure App config menu - could you confirm part of the job happens here ?

... a snippet of code I found here to supposedly retrieve a certificate that would have been store in an Azure KeyVault Secret

import base64, msal
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.serialization import pkcs12, Encoding, PrivateFormat, NoEncryption

# 1. Load credentials from Azure Key Vault
kv_url        = "https://your-keyvault.vault.azure.net"
tenant_id     = notebookutils.credentials.getSecret(kv_url, "sp-tenant-id")
client_id     = notebookutils.credentials.getSecret(kv_url, "sp-client-id")
cert_pfx_b64  = notebookutils.credentials.getSecret(kv_url, "sp-certificate")

# 2. Parse the PFX to extract what MSAL needs
private_key, certificate, _ = pkcs12.load_key_and_certificates(
    base64.b64decode(cert_pfx_b64), password=None
)
private_key_pem = private_key.private_bytes(Encoding.PEM, PrivateFormat.TraditionalOpenSSL, NoEncryption()).decode()
thumbprint      = certificate.fingerprint(hashes.SHA1()).hex().upper()

# 3. Acquire an access token
app = msal.ConfidentialClientApplication(
    client_id=client_id,
    client_credential={"private_key": private_key_pem, "thumbprint": thumbprint},
    authority=f"https://login.microsoftonline.com/{tenant_id}"
)

Would you happen to need any additional intel to help: I am available to provide them asap.