Parametrize authentication method of linked services

Question

Parametrize authentication method of linked services

Lina Lampel 0 Microsoft Employee

Hello,

we have the following set up: We have three data factory instances dev, preview and prod. Dev is connected to our repository. Preview and Prod are not. For all three instances, we have a linked service X which uses a system assigned identity (SAI) as an authentication method.

We now want to create a forth ADF instance, called dev2 with the same pipelines etc. however for the linked service X (Kusto cluster) we now want to use a user assigned identity (UAI). The new instance dev2 is also connected to the same repository as the existing instance dev.

How can we achieve parametrizing the authentication method for the linked service X such that one of the instances uses an UAI and the other uses an SAI?

1 answer

Your answer

Answer 1

Hi Lina Lampel,

It sounds like you're trying to configure a new Azure Data Factory instance (dev2) to use a User Assigned Identity (UAI) for a linked service, while keeping your existing instances (dev, preview, and prod) connected to a System Assigned Identity (SAI). You want to know how to parameterize this authentication method so that you can switch between SAI and UAI based on the instance.

Here's how you can achieve this:

Parameterize Your Linked Service:

In the Azure Data Factory, open the Linked Services settings for Linked Service X.
- You’ll want to add parameters for managedIdentity where you can specify whether to use an SAI or a UAI based on the parameters you provide.
Define Parameters:
```
- While defining the linked service JSON, you can add a `parameters` section, where you specify something like:

```json
{
```

"parameters": { "identityType": { "type": "string", "defaultValue": "SAI" } }, "typeProperties": { ... "managedIdentity": { "referenceName": "@{ linkedService().identityType }", "type": "ManagedIdentityReference" } } } ```

        - You would need to replace `linkedService().identityType` with the actual parameter reference.
        
        **Update Pipeline Activity**:
        
           - When you add or reference the linked service in your pipelines, you’ll supply the `identityType` parameter accordingly. For instance, in dev2, you would set it to "UAI", while in the others, you would keep it as "SAI".
           
           **Testing Your Configuration**:
           
              - After you parameterize the linked service and modify your pipelines, run a test to ensure everything works as expected.
              
              **Important Notes**:
              
                 - Make sure to manage permissions correctly for both UAI and SAI, ensuring that the data factory has the necessary roles assigned to these identities to access the resources needed.

This setup allows you to dynamically switch between different identity types depending on which Data Factory instance is running.

Additional Resources:

Hope this helps! If you have any other questions or need further clarification, feel free to ask!

Lina Lampel 0 Reputation points Microsoft Employee

2025-12-11T16:42:56.9533333+00:00

Thank you for the quick answer. Is there a way to not the identityType parameter for each ADF pipeline that uses the linked Service X separately, but instead to define it for the whole ADF instance?

So in one place for the dev instance specify that we want to use SAI and in one place for the dev2 instance specify that we want to use an UAI without changing the pipeline files at all.
VRISHABHANATH PATIL 2,305 Reputation points Microsoft External Staff Moderator

2025-12-12T03:03:59.2866667+00:00

Hi @Lina Lampel

Yes — the correct and supported way is to use ADF Global Parameters combined with CI/CD parameter overrides. This allows you to define the SAI/UAI choice once at the ADF instance level, not per pipeline, and without editing pipeline JSON.

This is the only Microsoft‑recommended pattern for factory‑wide settings that differ per environment.

Reference –

Global parameters - Azure Data Factory | Microsoft Learn

Parameterize linked services - Azure Data Factory & Azure Synapse | Microsoft Learn
Lina Lampel 0 Reputation points Microsoft Employee

2025-12-12T09:21:34.48+00:00

Hello,

unfortunately, this is not working for us currently. Currently, I am not even finding a way to parametrize the resourceId for a UAI correctly.

Here is what my credential looks like:

{ "name": "ExampleCredentialName", "properties": { "type": "ManagedIdentity", "typeProperties": { "resourceId": "@{pipeline().globalParameters.CredentialResourceId}" } } }

And here is what my factory file looks like where I set the global parameter for the factory that is actually connected to the repository:

{ "name": "ExampleFactoryName", "properties": { "globalParameters": { .... , "CredentialResourceId": { "type": "string", "value": "/subscriptions/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX/resourcegroups/exampleResourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ExampleCredentialName" } } } }

When I then test the connection in the UI I get the following error:

The referenced user assigned managed identity in the credential is not associated with the factory. Credential name: ExampleCredentialName, Managed identity resource id: @{pipeline().globalParameters.CredentialResourceId}

However, I know for a fact that this UAI is connected to the factory because if I instead do not use a parameter in the credential but just use the hardcoded resourceId, the connection works just fine:

{ "name": "ExampleCredentialName", "properties": { "type": "ManagedIdentity", "typeProperties": { "resourceId": "/subscriptions/XXXXXXXX-XXX-XXXX-XXXX-XXXXXXXX/resourcegroups/exampleResourceGroupName/providers/Microsoft.ManagedIdentity/userAssignedIdentities/ExampleCredentialName" } } }

Share via

Parametrize authentication method of linked services

1 answer

Additional Resources:

Your answer