Aembit eliminates static credentials from Azure Databricks pipelines by using cryptographic workload identity attestation at runtime. Instead of storing service principal secrets in pipeline configs, Aembit verifies the pipeline's identity via Azure Managed Identity or Databricks OIDC tokens, evaluates access policy, and issues short-lived ephemeral tokens for downstream services like Microsoft Graph or Salesforce. The tokens expire after use, nothing is stored in the pipeline, and all access events are logged for SIEM export. Two attestation granularities are supported: cluster-level (shared managed identity) and pipeline-level (per-job OIDC tokens or process identifiers). The pattern extends to any OAuth/OIDC-compatible service beyond Azure.
