Using Fabric notebook token to access Azure File Share (no SAS / keys)

Hi all,

Sharing something I was able to get working in a Fabric notebook, and I’m curious if others have tried something similar or have any thoughts on it. It’s not an officially documented or supported approach, so I’m also interested in perspectives on how likely this is to remain stable vs. potentially being deprecated in the future.

Goal:

• Access an Azure File Share from a Fabric notebook (Python)
• Avoid SAS tokens or account keys
• Use Fabric/workspace identity where possible

What did work was:

1. I ran the notebook in a pipeline using a Fabric/workspace identity connection.
2. Retrieving a token using notebookutils.credentials.getToken("https://storage.azure.com/")
3. Wrapping that token in a custom TokenCredential
4. Passing it into ShareServiceClient

With this approach I was able to:

• List files and directories
• Upload files
• Read files

Here is the full code:

# ---------------------------------------------
# Connecting to Azure File share using Fabric token
# ---------------------------------------------
import notebookutils
import time
from azure.core.credentials import AccessToken
from azure.core.credentials import TokenCredential
from azure.storage.fileshare import ShareServiceClient

# ===== CONFIG =====
storage_account_name = "<yourstorageaccountname>"
file_share_name = "<yourfilesharename>"
directory_path = ""  # "" = root
# ==================

# ---------------------------------------------
# Step 1: Get Fabric token
# ---------------------------------------------
raw_token = notebookutils.credentials.getToken(
    "https://storage.azure.com/"
)

# ---------------------------------------------
# Step 2: Wrap token in a TokenCredential
# ---------------------------------------------
class FabricTokenCredential(TokenCredential):
    def __init__(self, token):
        self._token = token

    def get_token(self, *scopes, **kwargs):
        # Set expiry ~1 hour from now
        return AccessToken(self._token, int(time.time()) + 3600)

credential = FabricTokenCredential(raw_token)

# ---------------------------------------------
# Step 3: Create client
# ---------------------------------------------
account_url = f"https://{storage_account_name}.file.core.windows.net"

service_client = ShareServiceClient(
    account_url=account_url,
    credential=credential,
    token_intent="backup"
)

# ---------------------------------------------
# Step 4: List contents
# ---------------------------------------------
share_client = service_client.get_share_client(file_share_name)
directory_client = share_client.get_directory_client(directory_path)

print(f"Listing contents of share '{file_share_name}':\n")

for item in directory_client.list_directories_and_files():
    if item['is_directory']:
        print(f"[DIR ] {item['name']}")
    else:
        print(f"[FILE] {item['name']} ({item['size']} bytes)")