Is it possible to get User Assigned Managed Identity bearer token via ADF on MSIT tenant?

Mohammad Sheraj 0

Can you please confirm if it is possible to do UAMI token generation via ADF on MSIT tenant? We do not have a PME subscription currently.

Stackoverflow questions:
https://stackoverflow.microsoft.com/questions/435481
https://stackoverflow.microsoft.com/questions/435730
https://stackoverflow.microsoft.com/questions/436389

Nandan Hegde 32,996 Reputation points MVP

2024-12-09T10:45:42.02+00:00

Is this what you are referring for :
https://learn.microsoft.com/en-us/answers/questions/1409588/generate-access-token-via-managed-identity
Mohammad Sheraj 0 Reputation points

2024-12-09T11:11:18.3233333+00:00

The link in the post https://learn.microsoft.com/en-us/answers/questions/1409588/generate-access-token-via-managed-identity which is https://stackoverflow.com/questions/74017863/adf-web-activity-get-access-token-with-post-api-using-system-assigned-managed-id%22https://stackoverflow.com/questions/74017863/adf-web-activity-get-access-token-with-post-api-using-system-assigned-managed-id%22 does not exist.

As for https://stackoverflow.com/questions/74017863/adf-web-activity-get-access-token-with-post-api-using-system-assigned-managed-id, it requires client_secret which we want to remove.

The ways that I have tried in

https://stackoverflow.microsoft.com/questions/435481
https://stackoverflow.microsoft.com/questions/435730

do not work due to 169.254.169.254 being blocked in ADF MSIT tenant.

I need the bearer token to make call to Magnetar via Livy APIs.
As per Use Livy API to submit spark jobs to MT | Bing MagneTar Platform Wiki

Do we require a PME Subscription?
Mohammad Sheraj 0 Reputation points

2024-12-09T11:12:55.75+00:00

I cannot use secrets.
Chandra Boorla 5,755 Reputation points Microsoft Vendor

2024-12-11T13:46:42.6233333+00:00

@Mohammad Sheraj

Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!

As I understand that you are trying to generate a User Assigned Managed Identity (UAMI) bearer token via Azure Data Factory (ADF) on MSIT tenant, given certain restrictions such as not having a PME (Private Multi-Enterprise) subscription and the inability to access the 169.254.169.254 endpoint for retrieving managed identity tokens.

Direct UAMI Token Generation in ADF - Currently, ADF itself does not natively support directly generating bearer tokens for a User-Assigned Managed Identity (UAMI). Token generation generally involves interacting with the Azure Instance Metadata Service (IMDS) or using an external REST API. However, the IMDS endpoint (169.254.169.254) is blocked in MSIT tenants, making direct retrieval within ADF not feasible in this environment.

Security Concern with Client Secrets - While some solutions suggest using client secrets to generate tokens. Using client secrets for authentication is not recommended in ADF because - ADF is primarily designed to work with secure, managed identities rather than requiring manual management of sensitive information like secrets. Storing secrets directly in ADF pipelines can expose sensitive data if not handled properly.

I hope this information helps. Please do let us know if you have any further queries.

Thank you.
Chandra Boorla 5,755 Reputation points Microsoft Vendor

2024-12-12T02:10:00.23+00:00

@Mohammad Sheraj

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 5,755 Reputation points Microsoft Vendor

2024-12-13T03:52:47.0966667+00:00

@Mohammad Sheraj

Following up to see on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Coder 0 Reputation points Microsoft Employee

2024-12-13T08:50:10.4433333+00:00

I have been able to generate my UAMI bearer token using Azure Function.

I needed to link my UAMI to my Azure Function.
This link tells that Azure Function is the only way to get bearer token in ADF as ADF REST API will not work for this. https://stackoverflow.com/questions/75401557/getting-access-token-for-azure-managed-identity-in-azure-datafactory-as-text

I have been successfully able to submit MT Spark job via Livy API.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Is it possible to get User Assigned Managed Identity bearer token via ADF on MSIT tenant?

1 answer

Your answer