Azure Data Explorer

Question

Azure Data Explorer

Michel SFEIR 20

Hello,

I was looking for a way to connect Azure Data Explorer to storage account that has public access disabled, I noticed that Vnet Injection was deprecated in February. Is there any other way to connect securely to a storage account?

Best Regards,

Michel

Michel SFEIR 20 Reputation points

2025-06-30T16:58:15.89+00:00

I tried "Enabled from selected virtual networks and IP addresses" and chose "Resource instances" then "Microsoft.Kusto/Clusters" and still gets the below error, knowing that I have both SMI and UMI on the ADX Cluster and both MI have Storage Blob Data Reader role and I waited for more than an hour to test.

"Invalid URL. Either the URL leads to a blob instead of a container, or the permissions are incorrect. If you just granted permission, please wait a couple minutes and try again"

Accepted answer

0 additional answers

Your answer

Michel SFEIR 20 Reputation points

2025-06-30T16:58:15.89+00:00

I tried "Enabled from selected virtual networks and IP addresses" and chose "Resource instances" then "Microsoft.Kusto/Clusters" and still gets the below error, knowing that I have both SMI and UMI on the ADX Cluster and both MI have Storage Blob Data Reader role and I waited for more than an hour to test.

"Invalid URL. Either the URL leads to a blob instead of a container, or the permissions are incorrect. If you just granted permission, please wait a couple minutes and try again"

Answer 1

Thanks for posting your question in the Microsoft Q&A forum

Managed private endpoints are the primary secure method for connecting Azure Data Explorer to storage accounts with public access disabled. Managed private endpoints create a one-way private connection from Azure Data Explorer to your storage account, ensuring that all traffic remains within the Azure backbone network and does not traverse the public internet

Managed identities provide another secure way to connect by allowing the Data Explorer cluster to authenticate as itself, without needing shared keys or secrets. You must configure the storage account to recognize Azure Data Explorer as a trusted service and create a network rule exception for trusted Azure services

This method can be used in conjunction with managed private endpoints or as an alternative for certain scenarios, but for storage accounts with public access disabled and strict network controls, managed private endpoints are preferred.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful

Michel SFEIR 20 Reputation points

2025-06-30T17:00:30.1833333+00:00

Hello hossein jalilian,

Thank you for replying, I will check your suggestion and get back to you. Any idea why my second attempt failed as well?
Michel SFEIR 20 Reputation points

2025-06-30T17:44:52.85+00:00

Thank you hossein jalilian, works fine.

Best Regards,

Michel

Share via

Azure Data Explorer

0 additional answers

Your answer