Skip to content

Implement resource ID retrieval for Azure authentication #2918

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
v-regandowner merged 4 commits into from
Jul 21, 2026
+17 −2
Merged

Implement resource ID retrieval for Azure authentication #2918

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
93598f0
Implement resource ID retrieval for Azure authentication
ohadbitt Jul 20, 2026
6e076c1
Update authenticate-with-msal.md
ohadbitt Jul 20, 2026
6340f3c
Refactor resource ID retrieval to C#
ohadbitt Jul 20, 2026
18fa484
Clarify MSAL authentication support for ingest endpoint
ohadbitt Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 17 additions & 2 deletions data-explorer/kusto/api/rest/authenticate-with-msal.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ request.Headers.Set(HttpRequestHeader.Authorization, string.Format(CultureInfo.I

## Perform application authentication with MSAL

The following code sample shows how to use MSAL to get an authorization token for your cluster. In this flow, no prompt is presented. The application must be registered with Microsoft Entra ID and have an app key or an X509v2 certificate issued by Microsoft Entra ID. To set up an application, see [Provision a Microsoft Entra application](../../access-control/provision-entra-id-app.md).
The following code sample shows how to use MSAL to get an authorization token for your cluster. In this flow, no prompt is presented. The application must be registered with Microsoft Entra ID and have an app key or an X509v2 certificate issued by Microsoft Entra ID. To set up an application, see [Provision a Microsoft Entra application](../../access-control/provision-entra-id-app.md). This is supported for the "ingest-" endpoint as well.

```csharp
var kustoUri = "https://<clusterName>.<region>.kusto.windows.net";
Expand All @@ -82,8 +82,23 @@ var authClient = ConfidentialClientApplicationBuilder.Create("<appId>")
.WithClientSecret("<appKey>") // Can be replaced by .WithCertificate to authenticate with an X.509 certificate
.Build();


string resourceId = null;

try
{
// Get the appropiate resource id by querying the metadata
var httpClient = new HttpClient();
var response = httpClient.GetByteArrayAsync($"{kustoUri}/v1/rest/auth/metadata").Result;
var json = JObject.Parse(Encoding.UTF8.GetString(response));
resourceId = json["AzureAD"]?["KustoServiceResourceId"]?.ToString();
}
catch {
resourceId = "https://kusto.kusto.windows.net";
}

var result = authClient.AcquireTokenForClient(
new[] { $"{kustoUri}/.default" } // Define scopes for accessing Azure Data Explorer cluster
new[] { $"{resourceId}/.default" } // Define scopes for accessing Azure Data Explorer cluster
).ExecuteAsync().Result;
var bearerToken = result.AccessToken;

Expand Down