Create a Microsoft Entra application registration in Azure Data Explorer

Microsoft Entra application authentication is used for applications, such as an unattended service or a scheduled flow, that need to access Azure Data Explorer without a user present. If you're connecting to an Azure Data Explorer database using an application, such as a web app, you should authenticate using service principal authentication. This article details how to create and register a Microsoft Entra service principal and then authorize it to access an Azure Data Explorer database.

Create Microsoft Entra application registration

Microsoft Entra application authentication requires creating and registering an application with Microsoft Entra ID. A service principal is automatically created when the application registration is created in a Microsoft Entra tenant.

The app registration can either be created in the Azure portal, or programatically with Azure CLI. Choose the tab that fits your scenario.

Configure delegated permissions for the application - optional

If your application needs to access your database by using the credentials of the calling user, configure delegated permissions for your application. For example, if you're building a web API and you want to authenticate by using the credentials of the user who is calling your API.

If you only need access to an authorized data resource, you can skip this section and continue to Grant a service principal access to the database.

1. Browse to the API permissions section of your App registration.

2. Select Add a permission.

3. Select APIs my organization uses.

4. Search for and select Azure Data Explorer.

   

5. In Delegated permissions, select the user_impersonation box.

6. Select Add permissions.

   

Grant a service principal access to the database

After creating your application registration, grant the corresponding service principal access to your database. The following example grants viewer access. For other roles, see Manage database permissions.

1. Use the values of Application ID and Tenant ID as copied in a previous step.

2. Execute the following command in your query editor, replacing the placeholder values ApplicationID and TenantID with your actual values:

   .add database <DatabaseName> viewers ('aadapp=<ApplicationID>;<TenantID>') '<Notes>'
   

   For example:

   .add database Logs viewers ('aadapp=1234abcd-e5f6-g7h8-i9j0-1234kl5678mn;9876abcd-e5f6-g7h8-i9j0-1234kl5678mn') 'App Registration'
   

   The last parameter is a string that shows up as notes when you query the roles associated with a database.

   Note

   After creating the application registration, you might need to wait several minutes until it can be referenced. If you receive an error that the application isn't found, wait and try again.

For more information on roles, see Role-based access control.

Use application credentials to access a database

Use the application credentials to programmatically access your database by using the client library.

. . .
string applicationClientId = "<myClientID>";
string applicationKey = "<myApplicationKey>";
string authority = "<myApplicationTenantID>";
. . .
var kcsb = new KustoConnectionStringBuilder($"https://{clusterName}.kusto.windows.net/{databaseName}")
    .WithAadApplicationKeyAuthentication(
        applicationClientId,
        applicationKey,
        authority);
var client = KustoClientFactory.CreateCslQueryProvider(kcsb);
var queryResult = client.ExecuteQuery($"{query}");

For more information, see How to authenticate with Microsoft Authentication Library (MSAL) in apps and use Azure Key Vault with .NET Core web app.

Troubleshooting

Invalid resource error

If your application authenticates users or applications for access, set up delegated permissions for the service application. Declare that your application can authenticate users or applications for access. If you don't, an error occurs when you attempt authentication. The error message is similar to the following message:

AADSTS650057: Invalid resource. The client has requested access to a resource which is not listed in the requested permissions in the client's application registration...

Follow the instructions in configure delegated permissions for the application.

Enable user consent error

Your Microsoft Entra tenant administrator might enact a policy that prevents tenant users from giving consent to applications. This situation results in an error similar to the following error when a user tries to sign in to your application:

AADSTS65001: The user or administrator has not consented to use the application with ID '<App ID>' named 'App Name'

Contact your Microsoft Entra administrator to grant consent for all users in the tenant, or enable user consent for your specific application.

Related content

• Kusto connection strings
• Create a Microsoft Entra application and service principal that can access resources