Automation outside Azure Databricks, GitHub Actions for example, swaps its OIDC token for a Databricks OAuth token as a service principal, as a federation policy allows, so there's no stored secret. Recommended for CI/CD.
Also called OAuth token federation.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Workload identity federation in context, with comparison tables and the common traps.
Terms in this definition
- Databricks
Analytics platform built on Apache Spark where data is processed in notebooks; Unity Catalog is the governance model it recommends.
- GitHub Actions
Event-driven workflow automation in GitHub, started by things like a push or pull request. Typical uses include deploying Bicep or CLI templates and launching Azure Machine Learning jobs with no manual step.
- OIDC
OpenID Connect, an OAuth 2.0-based identity standard that issues JSON ID tokens. VCF Identity Broker supports it, alongside SAML 2.0, for external IdPs.
- Token
The unit of text an LLM works with, which may be a word, part of a word or punctuation. Billing, limits and context windows are all counted in these units.
- OAuth
An authorisation standard allowing software to act for someone. In Azure Pipelines, choosing it for a GitHub service connection ties the connection to your own GitHub account; for integrations with Azure DevOps APIs, Microsoft Entra ID OAuth is the right choice.
- Service principal
The tenant-local instance of a managed identity or app registration, which users and Azure or directory roles are assigned to. Those from app registrations authenticate with a stored certificate or secret that needs rotating and can be copied, which suits code running outside Azure.
- Federation
An arrangement in which separate identity providers trust one another, letting people use the account from their home organisation to reach services in another domain. In a hybrid setup, Entra ID can pass sign-ins over to a federation service like AD FS.
- Exclusions
Scopes taken out of a policy assignment; they can only narrow its coverage, never widen it.