Forum Discussion
Connect to Azure App Configuration from Notebook using Workspace Identity
Hi Anonymous
Thank you for contacting the Microsoft Fabric community forum.This issue occurs because Microsoft Fabric notebooks do not provide access to the IMDS endpoint. As a result, ManagedIdentityCredential does not function, and any credential chain that depends on IMDS—including DefaultAzureCredential, even with a client_id—will fail.
Fabric workspace identity is different from Managed Identity. It uses OIDC workload identity, so you need to use WorkloadIdentityCredential instead.
The main issue here is this line: os.environ.get("AZURE_FEDERATED_TOKEN_FILE", "xx")
When the notebook session uses workspace identity, Fabric automatically sets AZURE_FEDERATED_TOKEN_FILE. By specifying a default value like "xx", you replace the correct value with an invalid path, causing the error:
token_file_path must be passed in or set AZURE_FEDERATED_TOKEN_FILE
To resolve this, first enable workspace identity in the Fabric workspace settings and restart the notebook session to ensure environment variables are set.
Next, set up the necessary permissions on the App Configuration resource by assigning the Fabric workspace identity the App Configuration Data Reader role or higher.
Then, use WorkloadIdentityCredential without passing any manual parameters. Fabric will automatically set AZURE_TENANT_ID, AZURE_CLIENT_ID, and AZURE_FEDERATED_TOKEN_FILE, so you do not need to set them yourself.
Here is an example of how the code should look in a Fabric notebook:
from azure.appconfiguration import AzureAppConfigurationClient
from azure.identity import WorkloadIdentityCredential
endpoint = " https://<your-app-config-name>.azconfig.io "
credential = WorkloadIdentityCredential()
client = AzureAppConfigurationClient(endpoint, credential)
setting = client.get_configuration_setting(key="test1")
print(setting.value)
With workspace identity enabled and the correct RBAC permissions, this code will authenticate and retrieve values from Azure App Configuration successfully.
If you have any further questions, please let us know and we’ll be happy to help.
Best Regards,
Microsoft Fabric Community Support Team.
I have the same problem and would allso appreciate guidance on setting and getting the Azure_FEDERATED_TOKEN_FILE. It is not availeble in the notebook even though the workspace has a workspace identy:
Hi KimTutein
This usually means that the notebook session is not running with workspace identity, even if it is enabled at the workspace level. Please review the steps I shared earlier, especially the notebook-level configuration. In the notebook Run settings, make sure Workspace identity is selected, then restart the notebook session so the environment variables are set. After restarting, check for AZURE_FEDERATED_TOKEN_FILE in a regular Python cell (not a %pip cell). If it's still None, the session isn't using workspace identity. This variable is set by Fabric only when the session starts and can't be set manually.
If you have any further questions, please let us know and we’ll be happy to help.
Best Regards,
Microsoft Fabric Community Support Team.
Hi v-karpurapud
Thank you very much for your reply - it is highly appreciated.
I am unsure of how I change the "notebook run session". Could you please explain me the steps with perhaps a screendump or two?
What I have done:
- added workspace identety to the workspace
- (as I want to try to use the workspace identety towards a Microsoft Foundry endpoint I have added the identry as an AI user in the Foundry project)
Any guidance would be highly appreciated
Hi KimTutein
To clarify the reference to “notebook run session,” the steps I mentioned earlier apply only to Python (non-Spark) notebooks in Microsoft Fabric. In Spark / PySpark notebooks, there is currently no option to change the run session or select an identity, which is why you are not seeing any related setting or UI option.
Because Spark notebooks do not support Workspace Identity, identity-related environment variables such as AZURE_FEDERATED_TOKEN_FILE are not injected, and restarting the session will not change this behavior. If Workspace Identity is required (for example, to use WorkloadIdentityCredential with Azure App Configuration or Microsoft Foundry), the supported approach is to use a Python (non-Spark) notebook, where the run session identity can be configured and the variables are provided automatically.
Best Regards,
Microsoft Fabric Community Support Team.