dlt-hub / dlt-hub/dlt

Add Microsoft Entra ID authentication methods to the MS SQL family destinations (SQL Server, Synapse, Fabric)

Open
#4,145 1 comment 0 reactions 1 assignee Claimed by @Travior View on GitHub
destination Feature needs decision
Dominant language
Python
Stars
5.9k
Forks
605
Avg merge
1d 14h
Merged PRs (30d)
38

Description

### Feature description

Add Microsoft Entra ID authentication to the `mssql`, `synapse`, and `fabric` destinations, covering both driver-native methods and token methods where dlt acquires and injects an access token.

### Use case

The MS SQL family destinations authenticate with SQL Server logins (username and password). Many Azure users, and all Fabric Warehouse users, authenticate with Microsoft Entra ID instead. Fabric Warehouse does not accept SQL logins at all, so without Entra ID support the destination cannot connect. Service principal, Azure CLI, environment, and managed-identity authentication are also needed for unattended/CI runs and for setups where no interactive login is available.

### Proposed solution

Add an `authentication` setting that selects one of:

- driver-native methods handled by the ODBC driver: `ActiveDirectoryServicePrincipal`, `ActiveDirectoryPassword`, `ActiveDirectoryIntegrated`, `ActiveDirectoryInteractive`;
- token methods where dlt uses `azure-identity` to acquire an access token and injects it through `attrs_before`, so they work cross-platform: `cli`, `environment`, `interactive`, `devicecode`, `managedidentity`, and `auto`/`default` (DefaultAzureCredential).

For Fabric, default to `ActiveDirectoryServicePrincipal` and fall back to DefaultAzureCredential when no service principal secret is configured.

### Related issues

N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.