Unable to get ADF Linked Service for Kusto to connected between tenants using system assigned managed identity

Question

Hello,

We need to create a Linked Service in ADF for Kusto where ADF is in one tenant, and the Kusto resource is in another tenant. We are using system assigned managed identity. The Kusto resource has been checked multiple times that it has the Object ID of the MI added.

We have also tried with Entra ID app.

The support team for the Kusto server does this type of onboarding regularly so we believe this is Entra ID related.

The error ADF gives is for the system assigned management identity:

ADF shows the error 11206 with a link to https://learn.microsoft.com/en-us/azure/data-factory/connector-troubleshoot-guide#error-code-11206 which has no mention of this code nor anything covering Kusto specifically.

Failed to connect to Kusto cluster 'https://<...>.kusto.windows.net/'. Unauthorized (401-Unauthorized): . This normally represents a permanent error, and retrying is unlikely to help. Error details: DataSource='https://<...>.kusto.windows.net/v1/rest/mgmt', DatabaseName='<...>', ClientRequestId='KD2RunCommand;b0872f38-f1f0-4d00-b85e-80b0a1d93aee', ActivityId='0a6657f5-dbb0-4709-a770-60af832484a9, Timestamp='2026-08-03T15:30:29.7976077Z'.

Answer 1

Hello MariusSundbakken-6312,

Greetings! Thanks for raising this question in Q&A forum.

Since you have already verified that the system-assigned managed identity object ID is added on the Azure Data Explorer (Kusto) side and have also tested with an Entra ID application, the 401 Unauthorized error typically indicates a cross-tenant authentication or consent issue rather than a simple permissions assignment problem.

1. Verify that the managed identity from the ADF tenant is recognized as an external principal in the Kusto tenant and has been granted the required database or cluster permissions.
2. Confirm that cross-tenant access settings in Microsoft Entra ID allow authentication between the ADF tenant and the Kusto tenant.
3. Test authentication using a user account from the same external tenant to confirm whether the issue is specific to managed identities or affects all cross-tenant authentication methods.
4. Review the Kusto cluster diagnostic logs using the provided Activity ID and ClientRequestId to identify the exact authorization failure.
5. Because the error persists with both Managed Identity and Entra ID application authentication, engage the tenant administrators and Microsoft Support early, providing the Activity ID, ClientRequestId, timestamp, tenant IDs, and cluster name for backend validation.

The next action is primarily with the tenant administrators and Microsoft Support. They should validate the cross-tenant Entra ID trust configuration and review backend authentication logs to determine why the token is being rejected by the Kusto cluster.

If this answer helps you kindly accept the answer which will help others who have similar questions

Best Regards,

Jerald Felix.