Is Cross Tenant support available between ADF and Kusto.?

Question

If ADF is in Tenant A and the Kusto cluster is in Tenant B. What auth could help me in this scenario.?

Answer 1

You need to use service principal authentication.

The service principal should be in the same tenant as the Kusto and must have access on it.

Managed identity wont work as they are diff tenants

Answer 2

Hi Ash,

Greetings for the day!

Thank you Nandan Hegde for answering, I would like to add few more details to your point.

based on your statement you're trying to figure out whether you can use Azure Data Factory (ADF) in one tenant to connect to a Kusto (Azure Data Explorer) cluster in another tenant.

Heres how you can set it up:

• Register a Service Principal: In the Azure Active Directory of Tenant B (where Kusto is located), register a new application to create a service principal.
• Assign Permissions: You need to grant the required permissions to this service principal on the Kusto cluster. To do this, go to the Kusto cluster settings and add the service principal as a user with the appropriate roles
• Use Service Principal in ADF: In your ADF pipeline, configure the linked service to use the registered service principal's credentials (Client ID and Client Secret). This way, ADF can authenticate to access Kusto securely.
• Managed Identities: managed identities won’t work across different tenants, so using a service principal is the best choice for cross-tenant scenarios.

Hope this helps, If you have any further questions, please just let us know.

Thanks!

Kalyani

Answer 3

Hello Ash,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to know if the Cross Tenant support available between ADF and Kusto.

For more details:

To establish secure cross-tenant access in Azure, it is recommended to avoid using Managed Identity since it is not supported across tenants, and instead rely on a Service Principal with RBAC for controlled access. Begin by registering an application in Tenant A’s Azure AD, ensuring it is set as multi-tenant if required, and note the Client ID, Tenant ID, and Client Secret - App registration guide.

Next, create an Enterprise Application in Tenant B using the Client ID, which automatically provisions a service principal - Enterprise app setup. Assign the service principal appropriate RBAC roles such as Storage Blob Data Contributor to enable data operations - RBAC roles reference.

In Azure Data Factory (ADF) of Tenant A, configure a linked service using Service Principal authentication, specifying the Tenant B ID - ADF linked service config.

To enhance security, use Azure Private Link by creating a private endpoint for Blob Storage in Tenant B, configure DNS resolution, firewall rules, and enable connectivity through VNet peering or VPN - Private Endpoint tutorial, DNS guide.

For scenarios involving Key Vault in Tenant B, set up a multitenant app registration in Tenant A, obtain consent from Tenant B, and assign the Key Vault Secrets User role to securely access secrets Cross-tenant Key Vault guide, Multitenant Key Vault architecture. Finally, ensure all configurations are well-documented to support auditing and troubleshooting.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.