Token generation using MSAL method

Question

We need to integrate oracle autonomous database using azure Entra ID . As per the oracle document we have to generate auth 2 token using MSAL method by running the python script.

https://learn.microsoft.com/en-us/azure/databricks/dev-tools/auth/aad-token-manual

Wanted to know below details.

Is the token generation is one time activity ?
Will the token get expire ?

Is there any option to generate the token apart from python script ?

Below is the document we are following to integrate Oracle database login with azure entra ID.
https://docs.oracle.com/en/learn/oracle-database-meid-integration/index.html#task-1-register-oracle-autonomous-database-with-microsoft-azure-app-registration

Answer 1

Hello Ganesan Rameshkumar,

Thanks, Amira Bedhiafi, for the clear and helpful response!

To build on that, here are a few additional points that may help Ganesan Rameshkumar integrating Oracle Autonomous Database with Azure Entra ID:

• As noted, access tokens issued by Entra ID typically last 60–90 minutes. Even if you generate a token manually via Python/MSAL, it must be refreshed for any long-running or recurring operation. For production scenarios, avoid hardcoding or manually rotating tokens—instead, use credential abstractions like DefaultAzureCredential from the Azure Identity library, which handles token caching and refresh automatically.
• When requesting a token for Oracle’s Entra-integrated database, ensure you’re using the correct scope. If your Oracle app registration uses an Application ID URI like api://<your-app-id>, the full scope should be api://<your-app-id>/.default. Using the wrong resource (e.g., the Databricks resource ID 2ff814a6-...) will result in an invalid audience (aud) claim, and Oracle will reject the token.
• Beyond Python: Yes, you can absolutely generate tokens without Python. For scripting or automation:
  • Azure CLI: az account get-access-token --resource api://<your-oracle-app-id>
  • PowerShell: Use Connect-AzAccount followed by Get-AzAccessToken -ResourceUrl "api://<your-oracle-app-id>"
  • REST API: Direct OAuth2 client credentials flow (ideal for service principals)
• If your integration runs unattended (e.g., from an app or pipeline), use a service principal with client credentials—not user credentials. User flows (like username/password) are discouraged and often blocked by Conditional Access policies.
• Validate your token: Before passing it to Oracle, decode it (e.g., at https://jwt.ms ) to confirm:
  • aud matches your Oracle app’s Application ID URI
    • tid matches your Entra tenant
      • exp is in the future

Finally, while the Databricks token manual page is referenced in your original query, note that Oracle’s integration uses its own app registration, so the Databricks-specific resource ID (2ff814a6-...) does not apply here—use Oracle’s app URI instead.

Hope this adds clarity!
Please "Accept as Answer" or Click "Yes" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush

Answer 2

Hello Ganesan !

Thank you for posting on Microsoft Learn Q&A.

You’ll generate access tokens repeatedly since they’re short lived by design.

Access tokens typically expire in 1 hour and you can set access-token lifetimes via Entra token-lifetime policy or enforce re-auth via Conditional Access.

You can use :

• Azure CLI
• PowerShell (Az)
• MSAL libraries in other languages
• Managed Identity / Azure Identity

For Oracle Autonomous Database with Entra ID, you need to authenticate against the App Registration that Oracle sets up, then pass that OAuth2 access token to the DB client. Oracle guide explicitly notes you can retrieve tokens using Azure CLI or PowerShell and place them where the tool expects them. The exact value you pass to --resource/--scope is the Application ID URI of the Oracle app you registered (often api://<app-id-guid>), then use /.default for scopes.

Links to help you :

https://learn.microsoft.com/en-us/azure/databricks/dev-tools/auth/aad-token-manual

https://learn.microsoft.com/en-us/entra/msal/python/getting-started/acquiring-tokens

https://learn.microsoft.com/en-us/python/api/overview/azure/identity-readme?view=azure-python

https://docs.oracle.com/en/learn/oracle-database-meid-integration/