I am currently working on an application that utilizes Azure Data Explorer, and I am attempting to use client credentials for authentication. While I have successfully authenticated, I encounter a 404 error whenever I attempt to perform any actions. Here are the steps I have taken and the configurations I have made: API Permissions: Azure Data Explorer: user_impersonation Microsoft Graph: offline_access, User.Read IAM Roles: In the Virtual Network and Subscription, I have assigned the following roles to my application: Contributor Owner User Access Administrator Cluster Permissions: Under "Security and network" in the Azure Data Explorer Cluster, I have added my application with the following roles: Cluster AllDatabasesAdmin Cluster AllDatabasesViewer Cluster AllDatabasesMonitor Database Permissions: For the specific database, I have assigned the following permissions to my application: Database Admin Database Viewer Database User Database UnrestrictedViewer Database Ingestor Database Monitor Despite these configurations, I continue to receive a 404 error when trying to perform the action of POST with URI template /v1/rest/query: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/api/rest/request Could you please assist me in identifying what might be causing this issue and provide guidance on how to resolve it? Does Data Explorer’s API support this flow? Thank youI

404 Error when Performing Actions in Azure Data Explorer with Client Credentials

itay4 36

I am currently working on an application that utilizes Azure Data Explorer, and I am attempting to use client credentials for authentication. While I have successfully authenticated, I encounter a 404 error whenever I attempt to perform any actions.

Here are the steps I have taken and the configurations I have made:

API Permissions:

Azure Data Explorer: user_impersonation
Microsoft Graph: offline_access, User.Read

IAM Roles:

In the Virtual Network and Subscription, I have assigned the following roles to my application:

Contributor
Owner
User Access Administrator

Cluster Permissions:

Under "Security and network" in the Azure Data Explorer Cluster, I have added my application with the following roles:

Cluster AllDatabasesAdmin
Cluster AllDatabasesViewer
Cluster AllDatabasesMonitor

Database Permissions:

For the specific database, I have assigned the following permissions to my application:

Database Admin
Database Viewer
Database User
Database UnrestrictedViewer
Database Ingestor
Database Monitor

Despite these configurations, I continue to receive a 404 error when trying to perform the action of POST with URI template /v1/rest/query:

https://learn.microsoft.com/en-us/azure/data-explorer/kusto/api/rest/request

Could you please assist me in identifying what might be causing this issue and provide guidance on how to resolve it? Does Data Explorer’s API support this flow?

Thank youI

PRADEEPCHEEKATLA 90,241 Reputation points

2024-06-14T09:08:01.89+00:00

@itay4 - Thanks for the question and using MS Q&A platform.

It seems like you are encountering a 404 error when trying to perform actions in Azure Data Explorer with client credentials. Based on the information you provided, it seems like you have configured the necessary API permissions, IAM roles, cluster permissions, and database permissions for your application. However, it is still unclear what might be causing the 404 error.

To better understand the issue, could you please provide more information on the specific request you are making when encountering the 404 error? Additionally, have you tried using any other authentication methods, such as user credentials, to see if the issue persists?

Regarding your question about whether Data Explorer's API supports this flow, it does support client credentials authentication. However, it is important to ensure that the necessary permissions and roles are configured correctly, as you have done.

Please provide more information on the specific request you are making, and we can work together to identify the issue and provide guidance on how to resolve it.

Looking forward for your response.
PRADEEPCHEEKATLA 90,241 Reputation points

2024-06-18T05:58:53.19+00:00

@itay4 - We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
itay4 36 Reputation points

2024-06-18T08:36:16.28+00:00

Thank you for your response. I am trying to perform the action of POST with the URI template /v1/rest/query (https://learn.microsoft.com/en-us/azure/data-explorer/kusto/api/rest/request). Curl for example:

curl -X POST https://help.kusto.windows.net/v1/rest/mgmt -H “Accept: application/json” -H “Authorization: Bearer <XX_REPLACED>” -H “Content-Type: application/json; charset=utf-8” -H “Expect: 100-Continue” --noproxy “*” -k -d ‘{“db”: “example”, “csl”: “.show queries | sort by StartedOn”}'

When I used the Device Code flow for authentication, the request was successful. I have also successfully performed the action using the User Credentials flow. However we need to use the Client Credentials flow.

I would greatly appreciate your assistance in resolving this issue. I would like to request a step-by-step explanation of what I should do to make this work.

I look forward to your response.
PRADEEPCHEEKATLA 90,241 Reputation points

2024-06-19T04:12:00.3966667+00:00
@itay4 - Thank you for providing more information. Based on your curl command, it seems that you are trying to perform a management operation (/v1/rest/mgmt) instead of a query operation (/v1/rest/query). Please ensure that you are using the correct URI template for your request.

Regarding the client credentials flow, here are the steps you can follow to authenticate and authorize your application to access Azure Data Explorer resources:

Create an Azure Active Directory (Azure AD) application and service principal in your Azure AD tenant. You can do this by following the steps outlined in the Azure AD documentation.

Assign the necessary API permissions to your Azure AD application. In this case, you will need to assign the "Azure Data Explorer: user_impersonation" permission.

Obtain an access token for your Azure AD application using the client credentials flow. You can do this by making a POST request to the Azure AD token endpoint with the necessary parameters. Here is an example curl command:

curl -X POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token -H "Content-Type: application/x-www-form-urlencoded" -d "client_id={client_id}&scope=https://kusto.windows.net/.default&client_secret={client_secret}&grant_type=client_credentials"

Replace {tenant}, {client_id}, and {client_secret} with the appropriate values for your Azure AD application.

Use the access token to authenticate and authorize your application to access Azure Data Explorer resources. You can do this by including the access token in the Authorization header of your HTTP requests. Here is an example curl command:

curl -X POST https://{cluster_name}.kusto.windows.net/v1/rest/query -H "Authorization: Bearer {access_token}" -H "Content-Type: application/json" -d '{"db": "{database_name}", "csl": "{query_string}"}'

Replace {cluster_name}, {access_token}, {database_name}, and {query_string} with the appropriate values for your Azure Data Explorer resources and query.

I hope this helps! Let me know if you have any further questions.
itay4 36 Reputation points

2024-06-23T07:59:38.7433333+00:00

Thank you for your help. I have added the API permission Azure Data Explorer: user_impersonation. However, when I try to run the first curl command, I receive the following output:

"error": "invalid_resource",

"error_description": "AADSTS500011: The resource principal named https://kusto.windows.net was not found in the tenant named <Azure AD tenant>. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.

"error_codes": 500011

"error_uri": "https://login.microsoftonline.com/error?code=500011"

Could you please provide the next steps I should follow to resolve this issue?

Thank you.
PRADEEPCHEEKATLA 90,241 Reputation points

2024-06-24T07:30:34.3766667+00:00

@itay4 - Based on the error message you received, it seems that the Azure AD tenant you are using does not have the necessary permissions to access the Azure Data Explorer resource.

To resolve this issue, you can follow these steps:

Make sure that you have the correct Azure AD tenant ID and that it is associated with the Azure subscription that you are using.

Check if the Azure Data Explorer resource is registered in your Azure AD tenant. You can do this by going to the Azure portal, selecting Azure Active Directory, and then selecting App registrations. If the resource is not registered, you can register it by selecting New registration and following the prompts.

Once the resource is registered, you need to grant the necessary permissions to your application. You can do this by going to the API permissions section of your application registration and adding the necessary permissions. In this case, you have already added the Azure Data Explorer: user_impersonation permission, so you can skip this step.

Finally, you need to grant admin consent to the permissions you added. You can do this by going to the API permissions section of your application registration and selecting Grant admin consent. This will prompt you to sign in as an Azure AD administrator and grant consent to the permissions.

After completing these steps, you should be able to run the curl command without receiving the "invalid_resource" error. If you still encounter issues, please let me know.
PRADEEPCHEEKATLA 90,241 Reputation points

2024-06-30T14:52:03+00:00

@itay4 - We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Share via

404 Error when Performing Actions in Azure Data Explorer with Client Credentials

Your answer