Enable Azure Resource Manager (ARM) API Authentication Using Fabric Workspace Identity

[Dhara_M]

Problem Statement

Microsoft Fabric Workspace Identity is positioned as a secure, secretless authentication mechanism for Fabric workloads. However, Fabric Notebooks currently cannot acquire Azure Resource Manager (ARM) access tokens (https://management.azure.com) using Workspace Identity via notebookutils.credentials.getToken().

This limitation prevents Fabric notebooks—whether executed interactively or via pipelines—from calling ARM APIs for essential operations such as:

• Azure subscription discovery
• Resource group and resource enumeration
• Governance, metadata, and automation use cases

The behavior is consistent across execution modes and identity contexts and appears to be a by-design restriction, as ARM is not a supported token audience today.

Current State / Workaround

The only functional workaround is to:

• Create a client secret for the Fabric Workspace Identity (Entra app registration),
• Store it in Azure Key Vault, and
• Use ClientSecretCredential in notebook code to acquire ARM tokens.

While technically viable, this approach:

• Reintroduces secret management and rotation
• Is functionally equivalent to using a traditional Service Principal
• Undermines the core value of Workspace Identity as a managed, secretless identity

Why This Matters (Customer Impact)

This limitation significantly restricts real-world enterprise scenarios, including:

• Centralized Azure governance and inventory solutions built on Fabric
• Automated metadata-driven pipelines
• Secure cross-subscription orchestration without secrets
• Compliance-driven environments where secret-based authentication is discouraged or prohibited

Customers adopting Fabric as a unified analytics and orchestration platform expect parity with Azure managed identity patterns, including secure ARM access without client secrets.

Proposed Enhancement

Enable native ARM token acquisition using Fabric Workspace Identity, for example:

• Support https://management.azure.com as a valid audience for:
  notebookutils.credentials.getToken("https://management.azure.com")
• Or provide an equivalent Fabric-supported, secretless mechanism to authenticate ARM API calls from notebooks and pipelines using Workspace Identity.

This would align Fabric Workspace Identity with Azure Managed Identity capabilities and unlock critical governance and automation scenarios.

Expected Benefits

• True end-to-end secretless authentication for Fabric workloads
• Improved security posture (no secrets, no rotation overhead)
• Greater adoption of Fabric for enterprise-scale governance and automation
• Reduced need for custom authentication patterns and workarounds