ADF - Support for Federated Identity Credentials

Based on the current published connector schema, ADF’s Azure Data Explorer linked service does not expose a federated-token or client-assertion field. It supports system-assigned managed identity, user-assigned managed identity, or a service principal with a key. So an app registration that only has an FIC cannot be used directly by the Kusto Command activity today. I also could not find a public commitment or date for native FIC support.

For a fully secretless ADF design, the simplest supported option is the factory’s system-assigned managed identity. This avoids creating another UAMI, although the existing Kusto/database permissions must be granted to that identity. If preserving the current application identity is mandatory, move the token exchange and Kusto call into compute that supports workload identity federation and a Kusto SDK custom token provider, then invoke it from ADF. That adds a component, but keeps secrets and certificates out of the pipeline.

For roadmap confirmation, I would raise a support case or track an Azure Feedback request.