Microsoft Fabric AI Skill Authentication Agent

This project provides a secure authentication solution for Microsoft Fabric AI Skills using Azure Key Vault for token management. It implements device flow authentication with MSAL (Microsoft Authentication Library) and securely stores tokens in Azure Key Vault.

• Secure token management using Azure Key Vault
• Device flow authentication for Microsoft Fabric AI Skills
• Token caching to minimize authentication requests
• Automatic token refresh handling
• Secure storage of authentication state

To use this project, you'll need:

1. An Azure subscription
2. An Azure Key Vault instance
3. A Microsoft Entra ID (formerly Azure AD) application registration
4. A Microsoft Fabric workspace with AI Skills enabled
5. Python 3.12 or later

1. Create an Azure Key Vault:

   az keyvault create --name "<your-keyvault-name>" --resource-group "<your-resource-group>" --location "<region>"

2. Grant your application permissions to access secrets:

   az keyvault set-policy --name "<your-keyvault-name>" --object-id "<your-app-object-id>" --secret-permissions get set delete

1. Register a new application in Microsoft Entra ID
2. Make note of the following values:
   • Application (client) ID
   • Directory (tenant) ID
3. Configure the application to allow device code flow authentication

1. Create a Microsoft Fabric workspace if you don't have one:

   az fabric workspace create --name "<your-fabric-workspace-name>" --resource-group "<your-resource-group>" --location "<region>"

2. Deploy an AI Skill in your Fabric workspace. Follow the Microsoft Fabric documentation to set up and deploy AI Skills.

Create a .env file with the following configuration:

# Fabric Access Related Information
FABRIC_WORKSPACE_ID="your-fabric-workspace-id"
FABRIC_AISKILL_ID="your-aiskill-id"
FABRIC_USER_QUESTION="your-test-question"
FABRIC_AISKILL_BASEURL="https://api.fabric.microsoft.com/v1/workspaces/{FABRIC_WORKSPACE_ID}/aiskills/{FABRIC_AISKILL_ID}/aiassistant/openai"

# EntraID required information for Token
AZURE_ENTRA_CLIENT_ID="your-client-id"
AZURE_ENTRA_TENANT_ID="your-tenant-id"

# Key Vault URL
KEY_VAULT_URL="https://your-keyvault-name.vault.azure.net/"

You will find a .env.fake file. Please, renamed it to .env and fullfill with your own data.

1. Clone this repository:

   git clone <repository-url>

2. Install required dependencies:

   pip install -r requirements.txt

The main functionality is provided through the MSALAuthenticator class in auth_keyvault.py. Here's a basic example:

from auth_keyvault import MSALAuthenticator

# Initialize the authenticator
auth = MSALAuthenticator()

# Get an access token
token = auth.get_token()

The authenticator will:

1. Check for cached tokens in Azure Key Vault
2. If no valid token exists, initiate device flow authentication
3. Cache the token in Key Vault for future use
4. Automatically handle token refresh when needed

• Never commit the .env file to version control
• Use managed identities when possible in production environments
• Regularly rotate client secrets and review access policies
• Monitor Key Vault access logs for security analysis

The project includes a devcontainer configuration for VS Code, which provides:

• Python 3.12 environment
• Azure CLI tools
• Required Python packages

This project is licensed under the MIT License - see the LICENSE file for details.

Contributions are welcome! Please feel free to submit a Pull Request.