Try to set scope as {your-api-client-id}/.default to get access token. Replace your-api-client-id with the client id/application id for your API app in Azure AD.

I guess there is no option to make this "host" token last longer. So I created a class to handle my PAT following databrick's 2.O API for tokens https://docs.databricks.com/dev-tools/api/latest/tokens.html

Thankfully PATs are automatically removed once they are expired. So I don't have to handle old PATs.

import json
from typing import Dict, List

import requests
from azure.identity import DefaultAzureCredential


class DatabricksTokenManager:
    """Databricks Token Manager. Based on https://docs.databricks.com/dev-tools/api/latest/index.html
    It uses `DefaultAzureCredential` to generate a short token for Databricks. Then it can manage Databricks PATs.
    """

    def __init__(self, databricks_host) -> None:
        """Init DatabricksTokenManager

        Args:
            databricks_host (str): Databricks host with out "https" or ending "/"
        """
        self._token = self._get_databricks_token()
        self.databricks_host = databricks_host
        self._pat = None

    @property
    def token(self) -> str:
        """Token property

        Returns:
            str: token value
        """
        return self._token

    @property
    def pat(self) -> str:
        """PAT property

        Returns:
            str: PAT value
        """
        return self._pat

    def _get_databricks_token(self) -> str:
        """Get auto generated token from Default Azure Credentials.
        If you are running this code in local. You need to run `az login`. Or set Service Principal Environment Variables.

        Returns:
            str: Databricks temporary Token
        """
        dbx_scope = "2ff814a6-3304-4ab8-85cb-cd0e6f879c1d/.default"
        return DefaultAzureCredential().get_token(dbx_scope).token


    def list_databricks_pats(self) -> List[Dict]:
        """List all PATs for this user in Databricks

        Returns:
            list: List of dicts containing PAT info
        """
        headers = {
            "Authorization": f"Bearer {self.token}",
        }
        response = requests.get(
            f"https://{self.databricks_host}/api/2.0/token/list", headers=headers
        )
        return response.json()["token_infos"]

    def create_databricks_pat(self, comment=None) -> str:
        """Create and return a new PAT from Databricks

        Args:
            comment (str:Optional): Comment to link to PAT. Default None
        Returns:
            str: PAT value
        """
        if comment is None:
            comment = "Token created from datalab-framework"

        headers = {
            "Content-type": "application/json",
            "Authorization": f"Bearer {self.token}",
        }
        json_data = {
            "application_id": "ce3b7e02-a406-4afc-8123-3de02807e729",
            "comment": comment,
            "lifetime_seconds": 86400, # 24 Hours
        }
        response = requests.post(
            f"https://{self.databricks_host}/api/2.0/token/create",
            headers=headers,
            json=json_data,
        )
        self._pat = response.json()["token_value"]
        return self._pat

    def remove_databricks_pat(self, pat_id):
        """Remove PAT from databricks

        Args:
            pat_id str: PAT ID
        """
        headers = {
            "Authorization": f"Bearer {self.token}",
            "Content-Type": "application/x-www-form-urlencoded",
        }
        data = {"token_id": f"{pat_id}"}
        requests.post(
            f"https://{self.databricks_host}/api/2.0/token/delete",
            headers=headers,
            data=json.dumps(data),
        )

Just to supplement the accepted answer with some more details, let me add that DefaultAzureCredential does log this information. For example, if you enable INFO-level logging:

import logging
from azure.identity import DefaultAzureCredential

logger = logging.getLogger('azure.identity')
logger.setLevel(logging.INFO)

handler = logging.StreamHandler(stream=sys.stdout)
formatter = logging.Formatter('[%(levelname)s %(name)s] %(message)s')
handler.setFormatter(formatter)
logger.addHandler(handler)

You'll see log messages like these from DefaultAzureCredential:

[INFO] DefaultAzureCredential - EnvironmentCredential is unavailable
[INFO] DefaultAzureCredential - ManagedIdentityCredential is unavailable
[INFO] DefaultAzureCredential - SharedTokenCacheCredential is unavailable
[INFO] DefaultAzureCredential acquired a token from VisualStudioCodeCredential

You'll see the failed attempts logged only the first time the DefaultAzureCredential instance acquires a token. Once one of its constituent credentials provides a token, it uses that credential exclusively. So this particular DefaultAzureCredential will always authenticate through Visual Studio Code, and in the logs you'll see this message whenever it does so:

[INFO] DefaultAzureCredential acquired a token from VisualStudioCodeCredential

You can set logging_enable to True when creating a DefaultAzureCredential object. This will then log which mechanism is being used. Just remember to configure logging in your app!

import logging
from azure.identity import DefaultAzureCredential

logging.basicConfig(level=logging.DEBUG)

cred = DefaultAzureCredential(logging_enable=True)

Any get_token() calls will show additional information including HTTP calls to AAD to help you see what is going on.

If you want a bit more control over which mechanisms you want to use then look at the ChainedTokenCredential class.

Bit late, but hopefully will be useful to people.

When I use the .net Microsoft.IdentityModel.Clients.ActiveDirectory library I don’t have to think about scope.

Actually, you have thought about it. When you use the code below via .net sdk, there is an aasUrl, this is the equivalent you need to specify in python sdk.

AuthenticationResult authenticationResult = await authContext.AcquireTokenAsync(aasUrl, clientCred);

With Microsoft.IdentityModel.Clients.ActiveDirectory, the method AcquireTokenAsync essentially uses the Azure AD client credential flow v1.0 endpoint to get the token, so this parameter is named as resource, i.e. the resource parameter in this method AcquireTokenAsync(String, ClientCredential).

In python sdk azure.identity, this method get_token essentially uses Azure AD client credential flow v2.0 endpoint to get the token, when v1.0 endpoint migrates to v2.0, there are some changes, one of them is the resource, it changed to scope, see this doc. When using scope, you need to specify the permission you want to access, you can also use /.default, then by default all the permissions added to the app will be requested.

So in your case, you just need to use the scope as aasUrl/.default, e.g. https://management.azure.com/.default, it depends on yourself.

token = credential.get_token("https://management.azure.com/.default")

Also have a test with the code on my side, it works fine.