Connect to Azure App Configuration from Notebook using Workspace Identity

[Anonymous]

Hi,

I want to connect to Azure App Configuration from Notebook. Am using defautazurecredential to get token ,also passed Workspace Identity in parameter like below but unable to get token.

%pip install azure-appconfiguration azure-identity

from azure.appconfiguration import AzureAppConfigurationClient

from azure.identity import DefaultAzureCredential

credential = DefaultAzureCredential(

    CLIENT_ID="xx-xx" 

) #passing here workspace identity

client = AzureAppConfigurationClient(endpoint, credential)

setting = client.get_configuration_setting(

    key="xyz"

)

Getting below error

EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured. Visit https://aka.ms/azsdk/python/identity/environmentcredential/troubleshoot to troubleshoot this issue. ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint.

[v-karpurapud]

Hi @Anonymous 

We have not received a response from you regarding the query and were following up to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.

Thank You.

[v-karpurapud]

Hi @Anonymous 

I wanted to check if you’ve had a chance to review the information provided. If you have any further questions, please let us know. Has your issue been resolved? If not, please share more details so we can assist you further.

Thank You.

[v-karpurapud · Accepted solution]

Hi @Anonymous 

Thank you for contacting the Microsoft Fabric community forum.

This issue occurs because Microsoft Fabric notebooks do not provide access to the IMDS endpoint. As a result, ManagedIdentityCredential does not function, and any credential chain that depends on IMDS—including DefaultAzureCredential, even with a client_id—will fail.

Fabric workspace identity is different from Managed Identity. It uses OIDC workload identity, so you need to use WorkloadIdentityCredential instead.

The main issue here is this line: os.environ.get("AZURE_FEDERATED_TOKEN_FILE", "xx")
 

When the notebook session uses workspace identity, Fabric automatically sets AZURE_FEDERATED_TOKEN_FILE. By specifying a default value like "xx", you replace the correct value with an invalid path, causing the error:

token_file_path must be passed in or set AZURE_FEDERATED_TOKEN_FILE

To resolve this, first enable workspace identity in the Fabric workspace settings and restart the notebook session to ensure environment variables are set.

Next, set up the necessary permissions on the App Configuration resource by assigning the Fabric workspace identity the App Configuration Data Reader role or higher.

Then, use WorkloadIdentityCredential without passing any manual parameters. Fabric will automatically set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE, so you do not need to set them yourself.

Here is an example of how the code should look in a Fabric notebook:

from azure.appconfiguration import AzureAppConfigurationClient

from azure.identity import WorkloadIdentityCredential

endpoint = " https://<your-app-config-name>.azconfig.io "

credential = WorkloadIdentityCredential()

client = AzureAppConfigurationClient(endpoint, credential)

setting = client.get_configuration_setting(key="test1")

print(setting.value)

With workspace identity enabled and the correct RBAC permissions, this code will authenticate and retrieve values from Azure App Configuration successfully.

 

If you have any further questions, please let us know and we’ll be happy to help.
 

Best Regards,

Microsoft Fabric Community Support Team.

[Anonymous]

from azure.appconfiguration import AzureAppConfigurationClient

from azure.identity import WorkloadIdentityCredential

import os

tenant_id = os.environ.get("AZURE_TENANT_ID","xx")

client_id = os.environ.get("AZURE_CLIENT_ID", "xx")

token_file = os.environ.get("AZURE_FEDERATED_TOKEN_FILE")

print("Tenant ID:", tenant_id)

print("Client ID:", client_id)

print("Token file:", token_file)

credential = WorkloadIdentityCredential(

    tenant_id=tenant_id ,

    client_id=client_id,

    token_file_path=token_file

)

endpoint = "test"

client = AzureAppConfigurationClient(endpoint, credential)

setting = client.get_configuration_setting(key="test1") Tried above solution and also by passing values , getting error as  'token_file_path' is required. Please pass it in or set the AZURE_FEDERATED_TOKEN_FILE environment variable. Expecting a token file path. Can you suggest on this

[Vinodh247]

DefaultAzureCredential + ManagedIdentity does not work in Fabric Notebooks. Use WorkloadIdentityCredential.

This fails because Fabric workspace identity does not expose the IMDS endpoint, so ManagedIdentityCredential will never work in a Notebook. Passing CLIENT_ID to DefaultAzureCredential does not switch it to workspace identity; it still tries Environment -> IMDS and fails, exactly as your error shows. In Fabric, workspace identity is implemented using OIDC workload identity, not MI. Use WorkloadIdentityCredential explicitly and do not rely on IMDS.

Correct approach should be as below:

from azure.appconfiguration import AzureAppConfigurationClient
from azure.identity import WorkloadIdentityCredential

credential = WorkloadIdentityCredential()

client = AzureAppConfigurationClient(endpoint, credential)
setting = client.get_configuration_setting(key="xyz")

Prerequisites:

• Workspace identity must be enabled in Fabric.

• That identity must have App Configuration Data Reader (or higher) on the App Configuration resource.

• Do not pass client id manually unless you have multiple identities.

[Anonymous]

Tried above solution and also by passing values , getting error as  'token_file_path' is required. Please pass it in or set the AZURE_FEDERATED_TOKEN_FILE environment variable. Expecting a token file path. Can you suggest on this?

[KimTutein]

I have the same problem and would allso appreciate guidance on setting and getting the Azure_FEDERATED_TOKEN_FILE. It is not availeble in the notebook even though the workspace has a workspace identy:

[v-karpurapud]

Hi @KimTutein 

This usually means that the notebook session is not running with workspace identity, even if it is enabled at the workspace level. Please review the steps I shared earlier, especially the notebook-level configuration. In the notebook Run settings, make sure Workspace identity is selected, then restart the notebook session so the environment variables are set. After restarting, check for AZURE_FEDERATED_TOKEN_FILE in a regular Python cell (not a %pip cell). If it's still None, the session isn't using workspace identity. This variable is set by Fabric only when the session starts and can't be set manually.

If you have any further questions, please let us know and we’ll be happy to help.
 

Best Regards,

Microsoft Fabric Community Support Team.

[KimTutein]

Hi @v-karpurapud 

Thank you very much for your reply - it is highly appreciated.

I am unsure of how I change the "notebook run session". Could you please explain me the steps with perhaps a screendump or two?

What I have done:

- added workspace identety to the workspace

- (as I want to try to use the workspace identety towards a Microsoft Foundry endpoint I have added the identry as an AI user in the Foundry project)

Any guidance would be highly appreciated

[v-karpurapud]

Hi @KimTutein 

To clarify the reference to “notebook run session,” the steps I mentioned earlier apply only to Python (non-Spark) notebooks in Microsoft Fabric. In Spark / PySpark notebooks, there is currently no option to change the run session or select an identity, which is why you are not seeing any related setting or UI option.

Because Spark notebooks do not support Workspace Identity, identity-related environment variables such as AZURE_FEDERATED_TOKEN_FILE are not injected, and restarting the session will not change this behavior. If Workspace Identity is required (for example, to use WorkloadIdentityCredential with Azure App Configuration or Microsoft Foundry), the supported approach is to use a Python (non-Spark) notebook, where the run session identity can be configured and the variables are provided automatically.

Best Regards,

Microsoft Fabric Community Support Team.

[KimTutein]

Thank you @v-karpurapud. That clearyfied it for me. 

Recards

Kim