Is it possible to get User Assigned Managed Identity bearer token via ADF on MSIT tenant?

Is this what you are referring for :
https://zcusa.951200.xyz/en-us/answers/questions/1409588/generate-access-token-via-managed-identity

The link in the post https://zcusa.951200.xyz/en-us/answers/questions/1409588/generate-access-token-via-managed-identity which is https://stackoverflow.com/questions/74017863/adf-web-activity-get-access-token-with-post-api-using-system-assigned-managed-id%22https://stackoverflow.com/questions/74017863/adf-web-activity-get-access-token-with-post-api-using-system-assigned-managed-id%22 does not exist.

As for https://stackoverflow.com/questions/74017863/adf-web-activity-get-access-token-with-post-api-using-system-assigned-managed-id, it requires client_secret which we want to remove.

The ways that I have tried in

https://stackoverflow.microsoft.com/questions/435481
https://stackoverflow.microsoft.com/questions/435730

do not work due to 169.254.169.254 being blocked in ADF MSIT tenant.

I need the bearer token to make call to Magnetar via Livy APIs.
As per Use Livy API to submit spark jobs to MT | Bing MagneTar Platform Wiki

Do we require a PME Subscription?

I cannot use secrets.

@Mohammad Sheraj

Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!

As I understand that you are trying to generate a User Assigned Managed Identity (UAMI) bearer token via Azure Data Factory (ADF) on MSIT tenant, given certain restrictions such as not having a PME (Private Multi-Enterprise) subscription and the inability to access the 169.254.169.254 endpoint for retrieving managed identity tokens.

Direct UAMI Token Generation in ADF - Currently, ADF itself does not natively support directly generating bearer tokens for a User-Assigned Managed Identity (UAMI). Token generation generally involves interacting with the Azure Instance Metadata Service (IMDS) or using an external REST API. However, the IMDS endpoint (169.254.169.254) is blocked in MSIT tenants, making direct retrieval within ADF not feasible in this environment.

Security Concern with Client Secrets - While some solutions suggest using client secrets to generate tokens. Using client secrets for authentication is not recommended in ADF because - ADF is primarily designed to work with secure, managed identities rather than requiring manual management of sensitive information like secrets. Storing secrets directly in ADF pipelines can expose sensitive data if not handled properly.

I hope this information helps. Please do let us know if you have any further queries.

Thank you.

@Mohammad Sheraj

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.