Does Azure Data Factory support Federated Identity Credential / Workload Identity Federation for ADLS Gen2 linked services?

Question

Does Azure Data Factory support Federated Identity Credential / Workload Identity Federation for ADLS Gen2 linked services?

Pradeep Ulindala 20 Microsoft Employee

I am trying to validate whether Azure Data Factory supports a secretless cross-tenant authentication pattern using Federated Identity Credential / Workload Identity Federation.

Scenario:

We have an Azure Data Factory pipeline / Copy Activity that needs to read data from an ADLS Gen2 / Azure Storage account.
The preferred authentication model is to avoid SAS tokens, account keys, client secrets, and certificates.
We would like to use an App Registration or Managed Identity with Federated Identity Credential / Workload Identity Federation.
The goal is for ADF to natively perform the token exchange and authenticate to the target storage account through a linked service.

Questions:

Does Azure Data Factory currently support App Registration + Federated Identity Credential / Workload Identity Federation as a native authentication option in linked services?
Specifically, is this supported for ADLS Gen2 / Azure Storage linked services used by Copy Activity?
If this is not supported, is there any recommended secretless alternative for cross-tenant storage access without using SAS, client secret, certificate, or account key?
Is this limitation connector-specific, or is it a general ADF platform limitation?
Is there any public roadmap or planned support for FIC/WIF in ADF linked services?

I reviewed the linked service authentication options and found support for models like Managed Identity, Service Principal, SAS, and account key, but I could not find clear documentation confirming support for Federated Identity Credential / Workload Identity Federation in ADF linked services

Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-08-12T20:29:02.4433333+00:00
Hi @Pradeep Ulindala

Based on the current Azure Data Factory documentation, Federated Identity Credential (FIC) / Workload Identity Federation (WIF) is not currently supported as a native authentication option for ADLS Gen2/Azure Blob Storage linked services in Azure Data Factory.

For the ADLS Gen2 connector, ADF supports authentication methods including Managed Identity, Service Principal, SAS, and Account Key. FIC/WIF is not listed as a supported authentication method for Copy Activity linked services.

For a secretless cross-tenant scenario, the recommended approach is to evaluate using an ADF system-assigned or user-assigned managed identity and grant that identity the required Azure RBAC permissions on the target storage account (for example, Storage Blob Data Reader for read-only access). This avoids SAS tokens, account keys, client secrets, and certificates.

It is important to distinguish this from FIC/WIF itself: Microsoft Entra ID supports workload identity federation, but ADF must explicitly implement the federation/token-exchange flow in the relevant linked-service connector. Configuring an FIC on an App Registration or managed identity does not, by itself, make FIC/WIF available as an ADF linked-service authentication method.

Therefore:

ADF + ADLS Gen2 + Managed Identity: Supported.

ADF + ADLS Gen2 + Service Principal: Supported.

ADF + ADLS Gen2 + FIC/WIF directly from a linked service: Not currently documented/supported.

Cross-tenant secretless access: Managed Identity with appropriate RBAC should be evaluated where the tenant/resource configuration permits it.

Roadmap: I would not confirm planned FIC/WIF support unless there is a public Microsoft roadmap item or official announcement specifically for ADF linked services.

If FIC/WIF is a hard requirement, an alternative architecture involving an intermediary workload/service that performs the federation flow may need to be considered.

For the latest supported authentication options, refer to the official Azure Data Factory Azure Blob Storage/ADLS Gen2 connector documentation: Azure Data Factory – Azure Blob Storage connector
Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-08-15T18:37:12.2233333+00:00

Hi @Pradeep Ulindala
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Answer accepted by question author

0 additional answers

Your answer

Pilladi Padma Sai Manisha 11,715 Reputation points Microsoft External Staff Moderator

2026-08-15T18:37:12.2233333+00:00

Hi @Pradeep Ulindala
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Answer 1

Hello @Pradeep Ulindala

Based on the current Azure Data Factory documentation, Federated Identity Credential (FIC) / Workload Identity Federation isn't exposed as a native authentication option for the ADLS Gen2 linked service.

The ADLS Gen2 connector currently documents these authentication methods:

Account key
SAS
Service principal
System-assigned managed identity
User-assigned managed identity

For service-principal authentication, ADF's documented linked-service configuration still expects an application/client secret. Managed Identity is the supported secretless option.

Therefore, ADF can't currently be configured so that an ADLS Gen2 linked service natively performs the FIC token exchange you've described. A similar cross-tenant FIC scenario has also been raised previously because the Federated Credential option isn't available in ADF linked services.

For same-tenant access, I would use the Data Factory's system-assigned or user-assigned managed identity and grant it the appropriate Storage Blob Data Reader/Contributor role and ADLS ACLs.

For the specific cross-tenant, secretless requirement, there doesn't appear to be a documented native ADF ADLS Gen2 linked-service pattern using workload identity federation today. You would need either a different authentication architecture or one of the currently supported linked-service authentication methods.

I also couldn't find a public Microsoft roadmap commitment for adding FIC/WIF authentication to ADF linked services, so I wouldn't provide an ETA.

Reference:

Microsoft Learn – Azure Data Lake Storage Gen2 connector for Azure Data Factory

https://learn.microsoft.com/en-us/azure/data-factory/connector-azure-data-lake-storage?

Hope this helps.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.

Allan Solomon Mejia 8,170 Reputation points

2026-08-15T19:24:36.2033333+00:00

Hello @Pradeep Ulindala

Please let me know if you need any further assistance. Otherwise, if the information provided has resolved your issue, please consider clicking “Accept Answer” to help others who may encounter the same problem.

Thank you!