Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
6 months ago
Solved

Connect to Azure App Configuration from Notebook using Workspace Identity

Hi,

 

I want to connect to Azure App Configuration from Notebook. Am using defautazurecredential to get token ,also passed Workspace Identity in parameter like below but unable to get token.

 

%pip install azure-appconfiguration azure-identity
from azure.appconfiguration import AzureAppConfigurationClient
from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential(
    CLIENT_ID="xx-xx" 
) #passing here workspace identity

client = AzureAppConfigurationClient(endpoint, credential)
setting = client.get_configuration_setting(
    key="xyz"
)
Getting below error
EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured. Visit https://aka.ms/azsdk/python/identity/environmentcredential/troubleshoot to troubleshoot this issue. ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint.
workspaces
  • v-karpurapud's avatar
    v-karpurapud
    6 months ago

    Hi Anonymous 

    Thank you for contacting the Microsoft Fabric community forum.

     

    This issue occurs because Microsoft Fabric notebooks do not provide access to the IMDS endpoint. As a result, ManagedIdentityCredential does not function, and any credential chain that depends on IMDS—including DefaultAzureCredential, even with a client_id—will fail.

    Fabric workspace identity is different from Managed Identity. It uses OIDC workload identity, so you need to use WorkloadIdentityCredential instead.

     

    The main issue here is this line: os.environ.get("AZURE_FEDERATED_TOKEN_FILE", "xx")
     

    When the notebook session uses workspace identity, Fabric automatically sets AZURE_FEDERATED_TOKEN_FILE. By specifying a default value like "xx", you replace the correct value with an invalid path, causing the error:

    token_file_path must be passed in or set AZURE_FEDERATED_TOKEN_FILE

     

    To resolve this, first enable workspace identity in the Fabric workspace settings and restart the notebook session to ensure environment variables are set.

     

    Next, set up the necessary permissions on the App Configuration resource by assigning the Fabric workspace identity the App Configuration Data Reader role or higher.

     

    Then, use WorkloadIdentityCredential without passing any manual parameters. Fabric will automatically set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE, so you do not need to set them yourself.

     

    Here is an example of how the code should look in a Fabric notebook:

     

    from azure.appconfiguration import AzureAppConfigurationClient

    from azure.identity import WorkloadIdentityCredential

    endpoint = " https://<your-app-config-name>.azconfig.io "

    credential = WorkloadIdentityCredential()

    client = AzureAppConfigurationClient(endpoint, credential)

    setting = client.get_configuration_setting(key="test1")

    print(setting.value)

     

    With workspace identity enabled and the correct RBAC permissions, this code will authenticate and retrieve values from Azure App Configuration successfully.

     

    If you have any further questions, please let us know and we’ll be happy to help.
     

    Best Regards,

    Microsoft Fabric Community Support Team.

11 Replies

  • v-karpurapud's avatar
    v-karpurapud
    Community Support
    6 months ago

    Hi Anonymous 

    Thank you for contacting the Microsoft Fabric community forum.

     

    This issue occurs because Microsoft Fabric notebooks do not provide access to the IMDS endpoint. As a result, ManagedIdentityCredential does not function, and any credential chain that depends on IMDS—including DefaultAzureCredential, even with a client_id—will fail.

    Fabric workspace identity is different from Managed Identity. It uses OIDC workload identity, so you need to use WorkloadIdentityCredential instead.

     

    The main issue here is this line: os.environ.get("AZURE_FEDERATED_TOKEN_FILE", "xx")
     

    When the notebook session uses workspace identity, Fabric automatically sets AZURE_FEDERATED_TOKEN_FILE. By specifying a default value like "xx", you replace the correct value with an invalid path, causing the error:

    token_file_path must be passed in or set AZURE_FEDERATED_TOKEN_FILE

     

    To resolve this, first enable workspace identity in the Fabric workspace settings and restart the notebook session to ensure environment variables are set.

     

    Next, set up the necessary permissions on the App Configuration resource by assigning the Fabric workspace identity the App Configuration Data Reader role or higher.

     

    Then, use WorkloadIdentityCredential without passing any manual parameters. Fabric will automatically set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE, so you do not need to set them yourself.

     

    Here is an example of how the code should look in a Fabric notebook:

     

    from azure.appconfiguration import AzureAppConfigurationClient

    from azure.identity import WorkloadIdentityCredential

    endpoint = " https://<your-app-config-name>.azconfig.io "

    credential = WorkloadIdentityCredential()

    client = AzureAppConfigurationClient(endpoint, credential)

    setting = client.get_configuration_setting(key="test1")

    print(setting.value)

     

    With workspace identity enabled and the correct RBAC permissions, this code will authenticate and retrieve values from Azure App Configuration successfully.

     

    If you have any further questions, please let us know and we’ll be happy to help.
     

    Best Regards,

    Microsoft Fabric Community Support Team.

  • Vinodh247's avatar
    Vinodh247
    Super User
    6 months ago

    DefaultAzureCredential + ManagedIdentity does not work in Fabric Notebooks. Use WorkloadIdentityCredential.

     

    This fails because Fabric workspace identity does not expose the IMDS endpoint, so ManagedIdentityCredential will never work in a Notebook. Passing CLIENT_ID to DefaultAzureCredential does not switch it to workspace identity; it still tries Environment -> IMDS and fails, exactly as your error shows. In Fabric, workspace identity is implemented using OIDC workload identity, not MI. Use WorkloadIdentityCredential explicitly and do not rely on IMDS.

     

    Correct approach should be as below:

    from azure.appconfiguration import AzureAppConfigurationClient
from azure.identity import WorkloadIdentityCredential

credential = WorkloadIdentityCredential()

client = AzureAppConfigurationClient(endpoint, credential)
setting = client.get_configuration_setting(key="xyz")

     

    Prerequisites:

    • Workspace identity must be enabled in Fabric.

    • That identity must have App Configuration Data Reader (or higher) on the App Configuration resource.

    • Do not pass client id manually unless you have multiple identities.

     

    • Anonymous's avatar
      Anonymous
      Not applicable
      6 months ago

      Tried above solution and also by passing values , getting error as  'token_file_path' is required. Please pass it in or set the AZURE_FEDERATED_TOKEN_FILE environment variable. Expecting a token file path. Can you suggest on this?

      • KimTutein's avatar
        KimTutein
        Advocate III
        6 months ago

        I have the same problem and would allso appreciate guidance on setting and getting the Azure_FEDERATED_TOKEN_FILE. It is not availeble in the notebook even though the workspace has a workspace identy:

         

         

  • Anonymous's avatar
    Anonymous
    Not applicable
    6 months ago
    from azure.appconfiguration import AzureAppConfigurationClient
    from azure.identity import WorkloadIdentityCredential
    import os

    tenant_id = os.environ.get("AZURE_TENANT_ID","xx")
    client_id = os.environ.get("AZURE_CLIENT_ID", "xx")
    token_file = os.environ.get("AZURE_FEDERATED_TOKEN_FILE")

    print("Tenant ID:", tenant_id)
    print("Client ID:", client_id)
    print("Token file:", token_file)

    credential = WorkloadIdentityCredential(
        tenant_id=tenant_id ,
        client_id=client_id,
        token_file_path=token_file
    )

    endpoint = "test"
    client = AzureAppConfigurationClient(endpoint, credential)
    setting = client.get_configuration_setting(key="test1") Tried above solution and also by passing values , getting error as  'token_file_path' is required. Please pass it in or set the AZURE_FEDERATED_TOKEN_FILE environment variable. Expecting a token file path. Can you suggest on this
  • v-karpurapud's avatar
    v-karpurapud
    Community Support
    6 months ago

    Hi Anonymous 

    I wanted to check if you’ve had a chance to review the information provided. If you have any further questions, please let us know. Has your issue been resolved? If not, please share more details so we can assist you further.

    Thank You.

  • v-karpurapud's avatar
    v-karpurapud
    Community Support
    6 months ago

    Hi Anonymous 

    We have not received a response from you regarding the query and were following up to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.

     

    Thank You.