Forum Discussion
Connect to Azure App Configuration from Notebook using Workspace Identity
Hi Anonymous
Thank you for contacting the Microsoft Fabric community forum.This issue occurs because Microsoft Fabric notebooks do not provide access to the IMDS endpoint. As a result, ManagedIdentityCredential does not function, and any credential chain that depends on IMDS—including DefaultAzureCredential, even with a client_id—will fail.
Fabric workspace identity is different from Managed Identity. It uses OIDC workload identity, so you need to use WorkloadIdentityCredential instead.
The main issue here is this line: os.environ.get("AZURE_FEDERATED_TOKEN_FILE", "xx")
When the notebook session uses workspace identity, Fabric automatically sets AZURE_FEDERATED_TOKEN_FILE. By specifying a default value like "xx", you replace the correct value with an invalid path, causing the error:
token_file_path must be passed in or set AZURE_FEDERATED_TOKEN_FILE
To resolve this, first enable workspace identity in the Fabric workspace settings and restart the notebook session to ensure environment variables are set.
Next, set up the necessary permissions on the App Configuration resource by assigning the Fabric workspace identity the App Configuration Data Reader role or higher.
Then, use WorkloadIdentityCredential without passing any manual parameters. Fabric will automatically set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE, so you do not need to set them yourself.
Here is an example of how the code should look in a Fabric notebook:
from azure.appconfiguration import AzureAppConfigurationClient
from azure.identity import WorkloadIdentityCredential
endpoint = " https://<your-app-config-name>.azconfig.io "
credential = WorkloadIdentityCredential()
client = AzureAppConfigurationClient(endpoint, credential)
setting = client.get_configuration_setting(key="test1")
print(setting.value)
With workspace identity enabled and the correct RBAC permissions, this code will authenticate and retrieve values from Azure App Configuration successfully.
If you have any further questions, please let us know and we’ll be happy to help.
Best Regards,
Microsoft Fabric Community Support Team.
DefaultAzureCredential + ManagedIdentity does not work in Fabric Notebooks. Use WorkloadIdentityCredential.
This fails because Fabric workspace identity does not expose the IMDS endpoint, so ManagedIdentityCredential will never work in a Notebook. Passing CLIENT_ID to DefaultAzureCredential does not switch it to workspace identity; it still tries Environment -> IMDS and fails, exactly as your error shows. In Fabric, workspace identity is implemented using OIDC workload identity, not MI. Use WorkloadIdentityCredential explicitly and do not rely on IMDS.
Correct approach should be as below:
from azure.appconfiguration import AzureAppConfigurationClient
from azure.identity import WorkloadIdentityCredential
credential = WorkloadIdentityCredential()
client = AzureAppConfigurationClient(endpoint, credential)
setting = client.get_configuration_setting(key="xyz")
Prerequisites:
Workspace identity must be enabled in Fabric.
That identity must have App Configuration Data Reader (or higher) on the App Configuration resource.
Do not pass client id manually unless you have multiple identities.
Tried above solution and also by passing values , getting error as 'token_file_path' is required. Please pass it in or set the AZURE_FEDERATED_TOKEN_FILE environment variable. Expecting a token file path. Can you suggest on this?
I have the same problem and would allso appreciate guidance on setting and getting the Azure_FEDERATED_TOKEN_FILE. It is not availeble in the notebook even though the workspace has a workspace identy:
Hi KimTutein
This usually means that the notebook session is not running with workspace identity, even if it is enabled at the workspace level. Please review the steps I shared earlier, especially the notebook-level configuration. In the notebook Run settings, make sure Workspace identity is selected, then restart the notebook session so the environment variables are set. After restarting, check for AZURE_FEDERATED_TOKEN_FILE in a regular Python cell (not a %pip cell). If it's still None, the session isn't using workspace identity. This variable is set by Fabric only when the session starts and can't be set manually.If you have any further questions, please let us know and we’ll be happy to help.
Best Regards,
Microsoft Fabric Community Support Team.
