404 Error when Performing Actions in Azure Data Explorer with Client Credentials

@itay4 - Thanks for the question and using MS Q&A platform.

It seems like you are encountering a 404 error when trying to perform actions in Azure Data Explorer with client credentials. Based on the information you provided, it seems like you have configured the necessary API permissions, IAM roles, cluster permissions, and database permissions for your application. However, it is still unclear what might be causing the 404 error.

To better understand the issue, could you please provide more information on the specific request you are making when encountering the 404 error? Additionally, have you tried using any other authentication methods, such as user credentials, to see if the issue persists?

Regarding your question about whether Data Explorer's API supports this flow, it does support client credentials authentication. However, it is important to ensure that the necessary permissions and roles are configured correctly, as you have done.

Please provide more information on the specific request you are making, and we can work together to identify the issue and provide guidance on how to resolve it.

Looking forward for your response.

@itay4 - We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank you for your response. I am trying to perform the action of POST with the URI template /v1/rest/query (https://video2.skills-academy.com/en-us/azure/data-explorer/kusto/api/rest/request). Curl for example:

curl -X POST https://help.kusto.windows.net/v1/rest/mgmt -H “Accept: application/json” -H “Authorization: Bearer <XX_REPLACED>” -H “Content-Type: application/json; charset=utf-8” -H “Expect: 100-Continue” --noproxy “*” -k -d ‘{“db”: “example”, “csl”: “.show queries | sort by StartedOn”}'

When I used the Device Code flow for authentication, the request was successful. I have also successfully performed the action using the User Credentials flow. However we need to use the Client Credentials flow.

I would greatly appreciate your assistance in resolving this issue. I would like to request a step-by-step explanation of what I should do to make this work.

I look forward to your response.

@itay4 - Thank you for providing more information. Based on your curl command, it seems that you are trying to perform a management operation (/v1/rest/mgmt) instead of a query operation (/v1/rest/query). Please ensure that you are using the correct URI template for your request.

Regarding the client credentials flow, here are the steps you can follow to authenticate and authorize your application to access Azure Data Explorer resources:

1. Create an Azure Active Directory (Azure AD) application and service principal in your Azure AD tenant. You can do this by following the steps outlined in the Azure AD documentation.

Assign the necessary API permissions to your Azure AD application. In this case, you will need to assign the "Azure Data Explorer: user_impersonation" permission.

Obtain an access token for your Azure AD application using the client credentials flow. You can do this by making a POST request to the Azure AD token endpoint with the necessary parameters. Here is an example curl command:

curl -X POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token -H "Content-Type: application/x-www-form-urlencoded" -d "client_id={client_id}&scope=https://kusto.windows.net/.default&client_secret={client_secret}&grant_type=client_credentials"

Replace {tenant}, {client_id}, and {client_secret} with the appropriate values for your Azure AD application.

Use the access token to authenticate and authorize your application to access Azure Data Explorer resources. You can do this by including the access token in the Authorization header of your HTTP requests. Here is an example curl command:

curl -X POST https://{cluster_name}.kusto.windows.net/v1/rest/query -H "Authorization: Bearer {access_token}" -H "Content-Type: application/json" -d '{"db": "{database_name}", "csl": "{query_string}"}'

Replace {cluster_name}, {access_token}, {database_name}, and {query_string} with the appropriate values for your Azure Data Explorer resources and query.

I hope this helps! Let me know if you have any further questions.

Thank you for your help. I have added the API permission Azure Data Explorer: user_impersonation. However, when I try to run the first curl command, I receive the following output:

"error": "invalid_resource",

"error_description": "AADSTS500011: The resource principal named https://kusto.windows.net was not found in the tenant named <Azure AD tenant>. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.

"error_codes": 500011

"error_uri": "https://login.microsoftonline.com/error?code=500011"

Could you please provide the next steps I should follow to resolve this issue?

Thank you.