Revision history [back]

The process of including the Azure Digital Twins Data Owner Role using the Azure Python SDK can be done by following these steps:

1. Install the Azure Python SDK. This can be done by following the instructions on the Azure SDK for Python page.
2. Create an Azure Active Directory (AAD) application and obtain a client ID and client secret.
3. Create a service principal for the application and assign the Digital Twins Data Owner role to it.
4. Use the Azure Python SDK to authenticate the application and obtain an access token.
5. Create a Digital Twins instance using the Azure Python SDK and grant access to the service principal using the access token obtained in step 4.
6. Use the Azure Python SDK to perform operations on the Digital Twins instance, such as creating models and instances, fetching data, etc.

Here's some Python code that demonstrates the process:

from azure.identity import ClientSecretCredential
from azure.mgmt.digitaltwins import DigitalTwinsManagementClient
from azure.mgmt.resource import ResourceManagementClient

# Azure subscription ID
subscription_id = '<your-subscription-id>'

# Azure Digital Twins instance name
digital_twins_instance_name = '<your-digital-twins-instance-name>'

# Azure AD client ID and secret for the AAD application
client_id = '<your-client-id>'
client_secret = '<your-client-secret>'

# Azure tenant ID
tenant_id = '<your-tenant-id>'

# Create a client credential object
credentials = ClientSecretCredential(
    tenant_id=tenant_id,
    client_id=client_id,
    client_secret=client_secret,
)

# Create a DigitalTwinsManagementClient object
digital_twins_client = DigitalTwinsManagementClient(
    credentials=credentials,
    subscription_id=subscription_id,
)

# Create a ResourceManagementClient object
resource_client = ResourceManagementClient(
    credentials=credentials,
    subscription_id=subscription_id,
)

# Create a service principal for the AAD application and assign the Digital Twins Data Owner role to it
sp = resource_client.service_principals.create_or_update(
    '<your-service-principal-name>',
    api_version='2019-05-01-preview',
    parameters={
        'account_enabled': True,
        'app_id': client_id,
        'password_credentials': [
            {
                'start_date': '2021-01-01T00:00:00Z',
                'end_date': '2021-12-31T23:59:59Z',
                'value': client_secret,
            }
        ],
        'role_assignments': [
            {
                'role_definition_id': '/providers/Microsoft.Authorization/roleDefinitions/2fecf2bf-8b1f-4ade-a71c-0e27037074fe',
                'principal_id': '<your-service-principal-object-id>',
            }
        ],
    }
)

# Authenticate the AAD application and obtain an access token
access_token = credentials.get_token('https://digitaltwins.azure.net').token

# Create a Digital Twins instance and grant access to the service principal using the access token
digital_twin = digital_twins_client.digital_twins.create_or_update(
    resource_group_name='<your-resource-group-name>',
    digital_twins_instance_name=digital_twins_instance_name,
    parameters={
        'sku': {
            'name': 'S1',
            'capacity': 1,
        },
        'location': '<your-location>',
        'identity': {
            'type': 'SystemAssigned',
        },
        'access_policies': [
            {
                'object_id': '<your-service-principal-object-id>',
                'tenant_id': tenant_id,
                'permissions': [
                    'Microsoft.DigitalTwins/digitalTwinsInstances/read',
                    'Microsoft.DigitalTwins/digitalTwinsInstances/write',
                ],
            },
        ],
    },
    kwargs={'headers': {'Authorization': 'Bearer ' + access_token}},
)

# Use the DigitalTwinsManagementClient object to perform operations on the Digital Twins instance
models = digital_twins_client.digital_twins.get_models(
    resource_group_name='<your-resource-group-name>',
    digital_twins_instance_name=digital_twins_instance_name,
    kwargs={'headers': {'Authorization': 'Bearer ' + access_token}},
)