Migrate AAD application authentication method from using App Secret to Federated Identity Credentials

[kuangweil]

Hi There,

We have an Azure Databricks python notebook (workflow) that is accessing Azure Data Explorer (Kusto) cluster using AAD application authentication method with a client secret (certificate). However, we're asked to migrate from using the secret to a federated identity credential (MSI FIC) for the application. Have anyone had experience of using FIC to authenticate the Kusto access using AAD application? If so, could you share how you did it? Thank you.

[rayluo]

MSI FIC is currently available in a preview. See the installation and docs there.

[bgavrilMS]

@kuangweil - for Python, it should be possible to do with Azure.Identity SDK, which is GA.

Something like:

Step1 - Use ManagedIdentityCredential to get a token for api://tokenExchange
Step2 - Use ClientAssertionCredential to get a token for your downstream service. Use the assertion from step1. Note that the assertion from step 1 expires.