Forum Discussion
Workload Identity Federation
Does Sharepoint Supports using WIF instead of SPN secrets in azure , Can we do that ? using ADF or notebook
9 Replies
Hi yashaswi_raj,
SharePoint Online itself doesn’t “support WIF” directly-the Microsoft Entra (Azure AD) app that calls SharePoint/Graph does. You can replace client secrets with Workload Identity Federation (WIF) for your app to obtain tokens without storing a secret, but today the Fabric/Data Factory SharePoint connectors are still wired for service principals (secret or certificate) in the connection UI. In notebooks, WIF only works if the runtime can present an OIDC token (e.g., GitHub Actions, AKS). Fabric notebook runtimes don’t expose an OIDC token source yet, so you’ll typically use a service principal with a certificate instead of a secret.If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
Hi tayloramy thanks for your response , Could you please explain on this
"You can replace client secrets with Workload Identity Federation (WIF) for your app to obtain tokens without storing a secret"how can we do this replacement , if u mean by creating the federated credentials on the spn , then what value should i give in the issuer and Subjected identifier in this case?
Hi yashaswi_raj,
Apologies, my phrasing was poor. If you're using Fabric connections, this isn't possible right now as Fabric doesn't present an OIDC token yet. If you're building something custom, you could do it yourself.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
Hi tayloramy , Could you please let me know the steps for configuring it for custom usage
Could you tell where can this custom usage be , i know in Azure Devops we can use the service connection but i wanted to know whether there is any way we can use WIF in ADF through web activity or Linked service.
for instance if i need to connect to Sharepoint from Azure ADF using WIF .
could you please let me know the steps for itHi yashaswi_raj ,
Currently, ADF and Fabric don’t directly support WIF for SharePoint connections they still require a service principal using a secret or a certificate.
If you want to use WIF, a common approach is to handle it externally create a federated credential in Entra, then use an Azure Function or Logic App to exchange the WIF token and call SharePoint. From ADF, you can trigger this via a Web Activity.
Just keep in mind, this requires some custom setup since it’s not a built in feature of ADF.
helpful reference
Workload Identity Federation - Microsoft Entra Workload ID | Microsoft Learn
Overview of federated identity credentials in Microsoft Entra ID - Microsoft Graph v1.0 | Microsoft…
Thank You.
Hi V-yubandi-msft / tayloramy ,
I am trying to run below code from my function app to connect to sharepoint using WIF , but i am getting below error , can you let me know if this is correct way or not , if not please let me know the changes.
raise CredentialUnavailableError(error_message) from ex
azure.identity._exceptions.CredentialUnavailableError: ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint.Code
from azure.identity import ManagedIdentityCredential, ClientAssertionCredential import requests # Constants MI_AUDIENCE = "api://AzureADTokenExchange" GRAPH_SCOPE = "https://graph.microsoft.com/.default" # Managed Identity credential (USMI client ID) managed_identity_credential = ManagedIdentityCredential( client_id="<clinet-id>" ) # Function to get token from MI def get_managed_identity_token(credential, audience): return credential.get_token(audience).token # ✅ Correct: Pass the lambda as the third positional argument client_assertion_credential = ClientAssertionCredential( "", # tenant_id "", # client_id lambda: get_managed_identity_token( managed_identity_credential, f"{MI_AUDIENCE}/.default" ) ) # Function to get access token def get_graph_token(): token = client_assertion_credential.get_token(GRAPH_SCOPE) return token.token # Function to call SharePoint via Microsoft Graph def call_sharepoint(): access_token = get_graph_token() headers = { "Authorization": f"Bearer {access_token}", "Accept": "application/json" } url = "https://graph.microsoft.com/v1.0/sites/y243c.sharepoint.com:/sites/SPNSite" resp = requests.get(url, headers=headers) if resp.status_code == 200: print("✅ SharePoint site info retrieved successfully:") print(resp.json()) else: print(f"❌ Failed to retrieve SharePoint site info. Status code: {resp.status_code}") print(resp.text) # Run the function if __name__ == "__main__": call_sharepoint()Hi yashaswi_raj ,
Thank you for providing the details.
The error message:
CredentialUnavailableError: ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint.typically indicates that your Function App cannot connect to the Managed Identity service (IMDS). This may occur if, The Managed Identity is not enabled on your Function App, or code is being executed locally instead of within Azure.
Here are a few things to check
1. Ensure the System assigned Managed Identity is enabled for your Function App
2. Run the code within the Function App in Azure, not locally, since IMDS is only available to Azure resources.
3. If you are using a system assigned identity, remove the client_id parameter, as it is only required for a user assigned identity.
Helpful Reference : Managed identities for Azure resources - Managed identities for Azure resources | Microsoft Learn
Thank you for your patience. Hope this help.
Hi yashaswi_raj ,
May I know if your issue has been resolved, or if you still need any additional details? Please let us know if there’s anything else we can help with.
Thank you.
Hi yashaswi_raj ,
May I know if your issue has been resolved, or if you still need any additional details? Please let us know if you need any further assistance.
Thank you.
