ADX KQL Restrict Statement Help

Question

I am using Azure Data Explorer and need to know how to write and where to put a KQL restrict statement such that only users of a specific group (e.g. 'aadgroup=foo') have access to the tables/functions of a database (e.g. 'censusDevTest'). How is such a statement written, and where?

Answer 1

Hello Michael,

You can do one thing, execute below command to restrict access to particular table or materialized view:

For Table:
.alter table <table_name> policy restricted_view_access true

For Materialized View:
.alter materialized-view <materialized-view_name>policy restricted_view_access true

And then assign Database unrestrictedviewer role to specific user. So he will only will be able to access that particular table or mv

And to managing roles and permissions, please take a look at below link:

https://learn.microsoft.com/en-us/azure/data-explorer/kusto/management/security-roles#managing-database-security-roles

If this solves your query, do click on Accept Answer.

Thanks,
Rahul

Answer 2

Hi @Anonymous ,

I assume you are looking for this

https://learn.microsoft.com/en-us/azure/data-explorer/kusto/management/rowlevelsecuritypolicy

If you have multiple Azure AD groups, and you want the members of each group to see a different subset of data, use this structure for an RLS query.

let IsInGroup1 = current_principal_is_member_of('aadgroup=******@domain.com');  
let IsInGroup2 = current_principal_is_member_of('aadgroup=******@domain.com');  
let IsInGroup3 = current_principal_is_member_of('aadgroup=******@domain.com');  
let DataForGroup1 = Customers | where IsInGroup1 and <filtering specific for group1>;  
let DataForGroup2 = Customers | where IsInGroup2 and <filtering specific for group2>;  
let DataForGroup3 = Customers | where IsInGroup3 and <filtering specific for group3>;  
union DataForGroup1, DataForGroup2, DataForGroup3