You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit bcadf23
Browse filesBrowse the repository at this point in the historyBrowse files
feat(credentials): Microsoft app credentials for Power BI and Azure Data Explorer, with national clouds (#9931)
* feat(credentials): resource-aware Microsoft app tokens and an optional national cloud
Microsoft app credentials resolve each service's token audience from one
table and cache minted tokens per credential, stored-secret version, and
audience, so services that need a different resource no longer share a
Graph-or-Dataverse key. A credential can name a national cloud (US
Government GCC High or DoD, or China); its Entra endpoint, certificate
assertion audience, and save-time Graph check follow that cloud. Global
credentials store no cloud field, so existing secrets and older workers
read them exactly as before, and Graph and Dataverse services refuse a
national-cloud credential because their tools call the global cloud.
* feat(powerbi): run Power BI as a Microsoft app credential
The Power BI service offers the Microsoft app credential beside its
delegated OAuth connection. A run or selector with an app credential gets
an app-only token for the Power BI REST API audience
(https://analysis.windows.net/powerbi/api/.default), cached apart from the
credential's Graph token; national-cloud credentials are refused because
the tools call api.powerbi.com. Delegated connections and every tool's
params are unchanged. The Power BI integration suite proves a run and a
selector end to end with a persisted app credential.
* feat(azure-data-explorer): run as a saved Microsoft app credential
Adds azure_data_explorer_v2, a credential-only successor whose picker
selects a Microsoft app credential (client secret, certificate, or keyless
federated credential) in place of the inline tenant ID, client ID, and
client secret. The executor authorizes the credential and the operation
mints a token for the cluster each call names: the audience is the
allowlisted cluster (or resource override) host as https://<host>, and the
credential's cloud must be one that host belongs to, so a US Government or
China cluster takes a matching national-cloud credential. Inline secrets
are never read on that path.
The legacy block keeps its inline fields and behavior and is marked legacy
with azure_data_explorer_v2 as its replacement. The connect dialog gains a
Cloud choice; a global credential's payload and stored secret are
unchanged.
* fix(credentials): decrypt Microsoft app secrets only on a token miss and scope the ADX operation
- Token cache key is named before decrypting, so a cached token skips the
decrypt and parse; Azure Data Explorer authorization no longer decrypts,
and its cluster key includes the resource's clouds.
- The ADX operation re-checks the credential against the run's workspace or
organization, as the AWS operation path does.
- A credential in the wrong Microsoft cloud is refused as cloud_mismatch with
its own message instead of "reconnect the credential"; ADX tool errors come
from the refusal code, not log detail.
- The operation-minted service comes from the shared ADX credential config.
- Reconnect reopens a national-cloud credential on its stored cloud.
- China signs in at login.partner.microsoftonline.cn (Entra national-cloud
reference) for both ADX auth paths; Kusto authorities derive from
MICROSOFT_CLOUDS.
- Drop the one-line ADX operations passthrough; refresh TSDoc and the Power BI
description.
* fix(credentials): refuse a national-cloud Microsoft app credential for Dataverse as a cloud mismatch
* refactor(credentials): read a reconnect's stored mode and cloud through one per-provider map
* fix(credentials): resolve a reconnect's cloud before saving and refuse a cross-cloud ADX resource
A Microsoft app reconnect now waits for the stored cloud, or asks for one when it cannot be
read (an organization credential or a failed lookup), instead of saving as global. The ADX
schema refuses a resource override whose cloud differs from the cluster's before any
credential is decrypted, and the Power BI description says app credentials run in the
global cloud only.
Copy file name to clipboardExpand all lines: apps/docs/content/docs/integrations/azure_data_explorer.mdx
+3-45Lines changed: 3 additions & 45 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: Azure Data Explorer
3
3
description: Query and manage Azure Data Explorer (Kusto) clusters with KQL
4
4
integration:
5
-
type: "azure_data_explorer"
5
+
type: "azure_data_explorer_v2"
6
6
color: "#FFFFFF"
7
7
---
8
8
@@ -32,7 +32,7 @@ In Sim, this integration gives your agents both halves:
32
32
-**Debug the pipeline** — list ingestion failures with their error codes and root causes, and check the state of a long-running operation
33
33
-**Run any management command** — the escape hatch for policies, mappings, and anything else on the control plane
34
34
35
-
Authentication uses a **Microsoft Entra service principal**(an app registration with a tenant ID, client ID, and client secret) rather than an interactive sign-in, so scheduled and unattended workflows keep working without anyone logging in. Grant that principal access to the database with `.add database <DATABASE> viewers ('aadapp=<clientId>;<tenantId>')` — use `viewers` for read-only agents, and `ingestors` or `users` only when a workflow needs to write.
35
+
Authentication uses a **Microsoft Entra app registration** rather than an interactive sign-in, so scheduled and unattended workflows keep working without anyone logging in. Select a saved [Microsoft app credential](/integrations/microsoft-app-credentials), which signs in with a client secret, a certificate, or a keyless federated credential; choose the credential's cloud to match the cluster (a `kusto.usgovcloudapi.net` cluster needs a US Government credential, a `kusto.chinacloudapi.cn` one a China credential). Sim mints a token for the cluster itself (`https://<cluster host>`) on each run. Grant the app access to the database with `.add database <DATABASE> viewers ('aadapp=<clientId>;<tenantId>')` — use `viewers` for read-only agents, and `ingestors` or `users` only when a workflow needs to write. Workflows built before saved credentials keep their inline tenant ID, client ID, and client secret.
36
36
37
37
A few things worth knowing before you build:
38
38
@@ -46,7 +46,7 @@ A few things worth knowing before you build:
46
46
47
47
## Use the block [#usage-instructions]
48
48
49
-
Run Kusto Query Language queries against Azure Data Explorer and Fabric Eventhouse clusters, discover databases, tables, and schemas, push small batches of rows inline, and run management commands. Authenticates with a Microsoft Entra service principal using client credentials, so no interactive sign-in is needed.
49
+
Run Kusto Query Language queries against Azure Data Explorer and Fabric Eventhouse clusters, discover databases, tables, and schemas, push small batches of rows inline, and run management commands. Runs as a Microsoft app credential: an app registration signing in with a client secret, a certificate, or a keyless federated credential, in the global cloud or a national cloud, so no interactive sign-in is needed.
50
50
51
51
## Actions
52
52
@@ -61,9 +61,6 @@ Run a Kusto Query Language (KQL) query against an Azure Data Explorer database a
61
61
| Parameter | Type | Required | Description |
62
62
| --------- | ---- | -------- | ----------- |
63
63
|`clusterUri`| string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net)|
64
-
|`tenantId`| string | Yes | Microsoft Entra tenant ID hosting the service principal |
65
-
|`clientId`| string | Yes | Microsoft Entra application \(client\) ID |
0 commit comments