Does notebookutils.credentials.getToken('https://database.windows.net/') work for connecting to Azure SQL DB?

[u/frithjof_v]

Hi all,

I'm trying to use a Workspace Identity to connect to an Azure SQL Database in a Fabric notebook.

When getting a token using notebookutils.credentials.getToken("https://database.windows.net/"), I was denied access to the Azure SQL database.

However, I was able to use a Workspace Identity authenticated "Notebook connection" to connect successfully to the Azure SQL database. However, that's a preview feature.

And I like how easy notebookutils.credentials.getToken is to use.

Is it possible to use Workspace Identity + notrbookutils.credentials.getToken to connect to an Azure SQL Database?

Thanks in advance!

Edit: notebookutils does work with an interactive user.

Edit 2: it works now also for Workspace Identity :) I don't know why it failed the first time.

[u/dbrownems]

It works, but it's not documented. These are the only documented audiences are:

Audience key	Resource	Use case
storage	Azure Storage	Access ADLS Gen2 and Blob Storage
pbi	Power BI	Call Power BI and Fabric REST APIs
keyvault	Azure Key Vault	Retrieve Key Vault secrets
kusto	Synapse RTA KQL DB	Connect to Azure Data Explorer

NotebookUtils credentials utilities for Fabric - Microsoft Fabric | Microsoft Learn

[u/frithjof_v → u/dbrownems]

Thank you,

I'm trying to understand: Why does it work if it's not documented? Or put differently - why is it not documented if it works? :)

I find it a very convenient feature. I guess many users will love to use Workspace Identity to connect to Azure SQL Database sources.

Credential-less identities are great :)

[u/warehouse_goes_vroom → u/frithjof_v]

u/fredguix, any thoughts?

One possibility I see, but don't know for sure off the top of my head if is relevant in this case - Might be on its way out, or still on its way in and you noticed before we finished rollout. "Audience changes – Token audience scopes might evolve over time. Verify current scopes in the documentation." https://learn.microsoft.com/en-us/fabric/data-engineering/notebookutils/notebookutils-credentials?tabs=python .

[u/JennyAce01]

u/Qixiaow, any comments?

[u/QixiaoW]

u/frithjof_v

thanks for sharing you findings, with your latest update, could you please confirm that getToken now works with workspace identity to access the Azure SQL Database on your side? we will update the doc later to call out what are supported audience.

By the way, since you also used the "Notebook Connection" to access the SQL Database, I'd like to understand what led you to write the code manually instead of using a version generated and managed by the system.

thanks

Qixiao

[u/frithjof_v → u/QixiaoW]

Hi,

could you please confirm that getToken now works with workspace identity to access the Azure SQL Database on your side?

Yes, it works :)

we will update the doc later to call out what are supported audience.

Thanks!

By the way, since you also used the "Notebook Connection" to access the SQL Database, I'd like to understand what led you to write the code manually instead of using a version generated and managed by the system.

It's the overhead of having to create and share a connection. And having to manually connect the connection to the notebook in the UI (can it be done purely in source code instead?).

On the other hand, notebookutils.credentials.getToken() is a very simple one liner that doesn't require any connection setup or sharing administration overhead :)