From 93598f011c970eca60d44858e7d1fc99efc95a96 Mon Sep 17 00:00:00 2001 From: ohad bitton <32278684+ohadbitt@users.noreply.github.com> Date: Mon, 20 Jul 2026 05:30:19 -0700 Subject: [PATCH 1/4] Implement resource ID retrieval for Azure authentication Added code to fetch resource ID from metadata for Azure Data Explorer authentication. --- .../kusto/api/rest/authenticate-with-msal.md | 25 ++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/data-explorer/kusto/api/rest/authenticate-with-msal.md b/data-explorer/kusto/api/rest/authenticate-with-msal.md index 78b7598d05..e88247fb18 100644 --- a/data-explorer/kusto/api/rest/authenticate-with-msal.md +++ b/data-explorer/kusto/api/rest/authenticate-with-msal.md @@ -82,8 +82,31 @@ var authClient = ConfidentialClientApplicationBuilder.Create("") .WithClientSecret("") // Can be replaced by .WithCertificate to authenticate with an X.509 certificate .Build(); +String resourceId = ""; + +try { + // Get the appropriate resource id by querying the metadata + URL url = new URL(queryEndpointUri + "/v1/rest/auth/metadata"); + HttpURLConnection conn = (HttpURLConnection) url.openConnection(); + conn.setRequestMethod("GET"); + conn.connect(); + + Scanner scanner = new Scanner(url.openStream(), StandardCharsets.UTF_8); + String jsonResponse = scanner.useDelimiter("\\A").next(); + scanner.close(); + + ObjectMapper mapper = new ObjectMapper(); + JsonNode jsonNode = mapper.readTree(jsonResponse); + resourceId = jsonNode.path("AzureAD").path("KustoServiceResourceId").asText("https://kusto.kusto.windows.net"); + // Append scope to resource id + resourceId = resourceId + "/.default"; +} catch (IOException e) { + System.err.println("Error fetching metadata: " + e.getMessage()); + resourceId = "https://kusto.kusto.windows.net/.default"; +} + var result = authClient.AcquireTokenForClient( - new[] { $"{kustoUri}/.default" } // Define scopes for accessing Azure Data Explorer cluster + new[] { $"{resourceId}/.default" } // Define scopes for accessing Azure Data Explorer cluster ).ExecuteAsync().Result; var bearerToken = result.AccessToken; From 6e076c12358d1e0c4cfd93cbeac8bc21488ab9e8 Mon Sep 17 00:00:00 2001 From: ohad bitton <32278684+ohadbitt@users.noreply.github.com> Date: Mon, 20 Jul 2026 05:37:35 -0700 Subject: [PATCH 2/4] Update authenticate-with-msal.md --- data-explorer/kusto/api/rest/authenticate-with-msal.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data-explorer/kusto/api/rest/authenticate-with-msal.md b/data-explorer/kusto/api/rest/authenticate-with-msal.md index e88247fb18..c49292c4dd 100644 --- a/data-explorer/kusto/api/rest/authenticate-with-msal.md +++ b/data-explorer/kusto/api/rest/authenticate-with-msal.md @@ -86,7 +86,7 @@ String resourceId = ""; try { // Get the appropriate resource id by querying the metadata - URL url = new URL(queryEndpointUri + "/v1/rest/auth/metadata"); + URL url = new URL(kustoUri + "/v1/rest/auth/metadata"); HttpURLConnection conn = (HttpURLConnection) url.openConnection(); conn.setRequestMethod("GET"); conn.connect(); From 6340f3cf0f095afed8b85dbfeeae9e1d69d34b0e Mon Sep 17 00:00:00 2001 From: ohad bitton <32278684+ohadbitt@users.noreply.github.com> Date: Mon, 20 Jul 2026 08:58:24 -0700 Subject: [PATCH 3/4] Refactor resource ID retrieval to C# Updated the method for fetching resource ID from Kusto service metadata, switching from Java to C# code. --- .../kusto/api/rest/authenticate-with-msal.md | 34 +++++++------------ 1 file changed, 13 insertions(+), 21 deletions(-) diff --git a/data-explorer/kusto/api/rest/authenticate-with-msal.md b/data-explorer/kusto/api/rest/authenticate-with-msal.md index c49292c4dd..50742140f1 100644 --- a/data-explorer/kusto/api/rest/authenticate-with-msal.md +++ b/data-explorer/kusto/api/rest/authenticate-with-msal.md @@ -82,27 +82,19 @@ var authClient = ConfidentialClientApplicationBuilder.Create("") .WithClientSecret("") // Can be replaced by .WithCertificate to authenticate with an X.509 certificate .Build(); -String resourceId = ""; - -try { - // Get the appropriate resource id by querying the metadata - URL url = new URL(kustoUri + "/v1/rest/auth/metadata"); - HttpURLConnection conn = (HttpURLConnection) url.openConnection(); - conn.setRequestMethod("GET"); - conn.connect(); - - Scanner scanner = new Scanner(url.openStream(), StandardCharsets.UTF_8); - String jsonResponse = scanner.useDelimiter("\\A").next(); - scanner.close(); - - ObjectMapper mapper = new ObjectMapper(); - JsonNode jsonNode = mapper.readTree(jsonResponse); - resourceId = jsonNode.path("AzureAD").path("KustoServiceResourceId").asText("https://kusto.kusto.windows.net"); - // Append scope to resource id - resourceId = resourceId + "/.default"; -} catch (IOException e) { - System.err.println("Error fetching metadata: " + e.getMessage()); - resourceId = "https://kusto.kusto.windows.net/.default"; + + string resourceId = null; + + try + { + // Get the appropiate resource id by querying the metadata + var httpClient = new HttpClient(); + var response = httpClient.GetByteArrayAsync($"{queryEndpointUri}/v1/rest/auth/metadata").Result; + var json = JObject.Parse(Encoding.UTF8.GetString(response)); + resourceId = json["AzureAD"]?["KustoServiceResourceId"]?.ToString(); +} +catch { + resourceId = "https://kusto.kusto.windows.net"; } var result = authClient.AcquireTokenForClient( From 18fa4842483f2b2d55ffae179af8f439171c477c Mon Sep 17 00:00:00 2001 From: ohad bitton <32278684+ohadbitt@users.noreply.github.com> Date: Tue, 21 Jul 2026 05:42:24 -0700 Subject: [PATCH 4/4] Clarify MSAL authentication support for ingest endpoint Updated the code sample to clarify that the MSAL authentication flow is supported for the 'ingest-' endpoint. --- data-explorer/kusto/api/rest/authenticate-with-msal.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data-explorer/kusto/api/rest/authenticate-with-msal.md b/data-explorer/kusto/api/rest/authenticate-with-msal.md index 50742140f1..b7767e60db 100644 --- a/data-explorer/kusto/api/rest/authenticate-with-msal.md +++ b/data-explorer/kusto/api/rest/authenticate-with-msal.md @@ -72,7 +72,7 @@ request.Headers.Set(HttpRequestHeader.Authorization, string.Format(CultureInfo.I ## Perform application authentication with MSAL -The following code sample shows how to use MSAL to get an authorization token for your cluster. In this flow, no prompt is presented. The application must be registered with Microsoft Entra ID and have an app key or an X509v2 certificate issued by Microsoft Entra ID. To set up an application, see [Provision a Microsoft Entra application](../../access-control/provision-entra-id-app.md). +The following code sample shows how to use MSAL to get an authorization token for your cluster. In this flow, no prompt is presented. The application must be registered with Microsoft Entra ID and have an app key or an X509v2 certificate issued by Microsoft Entra ID. To set up an application, see [Provision a Microsoft Entra application](../../access-control/provision-entra-id-app.md). This is supported for the "ingest-" endpoint as well. ```csharp var kustoUri = "https://..kusto.windows.net"; @@ -89,7 +89,7 @@ var authClient = ConfidentialClientApplicationBuilder.Create("") { // Get the appropiate resource id by querying the metadata var httpClient = new HttpClient(); - var response = httpClient.GetByteArrayAsync($"{queryEndpointUri}/v1/rest/auth/metadata").Result; + var response = httpClient.GetByteArrayAsync($"{kustoUri}/v1/rest/auth/metadata").Result; var json = JObject.Parse(Encoding.UTF8.GetString(response)); resourceId = json["AzureAD"]?["KustoServiceResourceId"]?.ToString(); }