How to run a purge command in ADX using ADF?

Absolutely. These are placeholders.

I tried changing the Base URL from the Kusto URI to the Ingest URI, with everything else the same. And then tried running the same command, but now it gives this permission error:
"Response": "Forbidden: Caller is not authorized to perform this action\r\nError details:\r\nClientRequestId='unspecified;
But the 'app' permissions configured for ADF, in the ADX Security + Networking > Permissons, already has "Cluster AllDatabasesAdmin" Role. So what permission is missing here?

Whereas the .show purges in database DBName" command is working with the ingest- endpoint as base URL.

Yes, absolutely, those are placeholders.

But here's what I tried:

1. Changed the Base URL in Web Activity to the ingest- endpoint for ADX(it was the ADX Cluster URI earlier).
2. Ran a .show purges in database DBName command which worked.
3. Tried the above .purge table MyTable in database DBName allrecords and I get the error : Forbidden: Caller is not authorized to perform this action Error details: ClientRequestId='unspecified; .

Under the Security + Networking > Permissions section in ADX, I see that the app for ADF already has the role 'Cluster AllDatabasesAdmin'. So I'm not sure what permission is missing now.

When using a managed identity you need to set the managed identity policy in Azure Data Explorer

See instruction: https://video2.skills-academy.com/en-us/azure/data-explorer/ingest-data-managed-identity#set-the-managed-identity-policy-in-azure-data-explorer

@Sailesh Choyal - We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

@Wilko van de Velde
I had enabled the Ingestion role (it already had Admin All Access role) for ADF from the Identity config. After that I'm trying to run this command from the Web Activity in ADF (using a POST request).

.alter-merge cluster policy managed_identity "[ { 'ObjectId' : 'ObjectId', 'AllowedUsages' : 'NativeIngestion' }]"

And it throws this error:

InternalServiceError (520-UnknownError): {
    "error": {
        "code": "Internal service error",
        "message": "Request aborted due to an internal service error.",
        "@type": "Kusto.Cloud.Platform.Utils.UtilsInvalidOperationException",
        "@message": "Error assigning managed identity policy. Please verify the managed identity is assigned to your cluster. If so, retry again in a few moments.",

How do I get past this?

@Sailesh Choyal - The error message suggests that there might be an issue with the managed identity policy assignment. Please verify that the managed identity is assigned to your cluster. If it is, then you can try again in a few moments.

Also, please make sure that you have provided the correct ObjectId in the command. The ObjectId should be the Object ID of the managed identity that you have assigned to your cluster.

You can use the following command to get the Object ID of the managed identity: https://video2.skills-academy.com/en-us/cli/azure/identity?view=azure-cli-latest#az-identity-show

az identity show

Once you have the Object ID, you can replace the 'ObjectId' in your command with the actual Object ID of the managed identity.

If the issue persists, please provide more information about your setup and the steps you have followed so that I can assist you better.

@PRADEEPCHEEKATLA-MSFT

The ADF instance has a system-assigned managed identity, which we're using. But isn't az identity only for a user identity? (correct me if I'm wrong). Do we need to use a user identity instead of system assigned?