FabricWorkspaceIdentityCredential

Azure credential adapter backed by the Microsoft Fabric workspace identity.

class scamander.secrets.fabric_credential.FabricWorkspaceIdentityCredential(audience: str = 'keyvault')

Bases: object

Adapt notebookutils.credentials.getToken to the TokenCredential protocol.

Microsoft Fabric notebooks run under a workspace identity (a managed identity tied to the workspace) rather than exposing IMDS, environment-variable, or CLI credentials — so DefaultAzureCredential cannot authenticate inside a Fabric notebook. notebookutils.credentials.getToken is the Fabric-native way to obtain an AAD access token for that identity, but it returns a plain string rather than an AccessToken. This class adapts it so it can be passed as the credential argument to AzureKeyVaultProvider.

Grant the workspace identity the “Key Vault Secrets User” role on the target Key Vault before using this credential — see docs/fabric-keyvault-credential-setup.md.

Parameters:

audience – Resource audience passed to notebookutils.credentials.getToken. Defaults to "keyvault", which scopes the token to Azure Key Vault.

Example:

from scamander.secrets import AzureKeyVaultProvider, FabricWorkspaceIdentityCredential
from scamander.processor.platform import Platform

platform = Platform(
    secret_provider=AzureKeyVaultProvider(
        default_vault="my-keyvault",
        credential=FabricWorkspaceIdentityCredential(),
    ),
)
password = platform.get_secret("pg-password")

get_token(*scopes: str, **kwargs: object) → AccessToken

Fetch a fresh token for the workspace identity.

Parameters:

• *scopes – Ignored — notebookutils scopes the token via audience instead of OAuth scopes. Accepted only to satisfy the TokenCredential protocol.

• **kwargs – Ignored, accepted for protocol compatibility.

Returns:

An AccessToken wrapping the string token returned by notebookutils.credentials.getToken.

Raises:

• ImportError – When azure-core is not installed.

• RuntimeError – When not running inside a Fabric notebook runtime (notebookutils unavailable).