feat(credentials): Microsoft app credentials for Power BI and Azure Data Explorer, with national clouds by waleedlatif1 · Pull Request #9931 · simstudioai/sim

waleedlatif1 · 2026-11-12T11:50:35Z

Summary

Microsoft app credentials now mint tokens per resource. The cache key is credential + stored-secret version + audience, and one table maps each service to its audience. Graph services share one token; every other resource gets its own. The secret is decrypted only on a cache miss, inside the shared mint, so a cached token costs one row read.
New optional cloud on the credential: Global (default), US Gov GCC High, US Gov DoD, or China (21Vianet). The Entra endpoint, the certificate assertion audience and the save-time Graph check follow the cloud. China signs in at login.partner.microsoftonline.cn, the endpoint the Entra national-cloud reference lists and the one legacy inline ADX sign-ins already use. Graph, Power BI and Dataverse services refuse a national-cloud credential with a new cloud_mismatch code, whose message names the cloud mismatch instead of asking the user to reconnect. A reconnect opens on the credential's stored cloud. The reconnect reads the stored mode and cloud through one per-provider map, with no provider-specific branch.
Power BI accepts a Microsoft app credential next to its delegated connection. Token audience: https://analysis.windows.net/powerbi/api/.default. Global cloud only.
New azure_data_explorer_v2, a credential-only block. The token audience is the allowlisted cluster (or resource-override) host. The credential's cloud must match the cluster's cloud, so a national-cloud cluster needs a matching national-cloud credential. The operation re-checks the credential against the run's workspace or organization, as the AWS operation path does. The legacy block keeps its inline fields and is marked legacy.

Not in this PR (design memos):

Azure DevOps service principal. The service-principal guide (https://learn.microsoft.com/en-us/azure/devops/integrate/get-started/authentication/service-principal-managed-identity) uses the token scope https://app.vssps.visualstudio.com/.default, sent as Bearer. Azure DevOps ignores Entra app permissions. The service principal must be added to each organization as a user, with Basic or higher access, and it takes a paid license. Two things block it:
- Each service holds one serviceAccountProviderId (lib/oauth/types.ts), and Azure DevOps already uses it for its PAT credential. Offering an app credential needs either a list-valued provider-id field across pickers, the resolver and the block contract, or a new provider id.
- Every Azure DevOps tool hard-codes a Basic PAT header. Switching to Bearer means passing the credential kind through credentialParams in every tool, which changes their tool schemas.
It needs a product decision on the credential model and a live proof.
Azure OpenAI via Entra. The Entra guide (https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/managed-identity) uses the data-plane scope https://ai.azure.com/.default. It requires a custom-subdomain endpoint and the Cognitive Services OpenAI User role. The provider takes an inline API key and a user-supplied endpoint, and model providers have no saved-credential path yet. It needs that model-credential pattern, an endpoint host allowlist (*.openai.azure.com) and a client cache keyed by credential and expiry.
Planner/Outlook app-only. Graph's /me requires a signed-in user, and application permissions are not supported there (https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0). These tools call /me. App-only would need a new user or mailbox parameter that switches to /users/{id}, and tenant-wide mailbox scope is a product and security decision.

Product update (if relevant)

Admins can run Power BI and Azure Data Explorer as an Entra app registration (client secret, certificate, or keyless federated credential), including in US Government and China clouds for ADX. Setup steps are in the Microsoft app credentials and per-integration docs.

Type of Change

Testing

Unit:
- Per-audience cache separation; a cached token is served without decrypting; the ADX cluster key includes the resource's clouds.
- National-cloud endpoints and assertion audience; cloud_mismatch refusals for Graph, Dataverse, Power BI and ADX.
- The reconnect returns the stored mode and cloud.
- ADX operation tests: runs with no inline secret, ignores inline sign-in fields, takes the audience from the override host, refuses a cluster in another cloud (400) before any request, refuses a credential from another workspace before decrypting, refuses a non-allowlisted host before decrypting, does not echo Entra's error detail, keeps the legacy inline path.
Integration (real Postgres): Power BI run and selector with a persisted app credential.
Generated artifacts, block-registry check (saved-credential contract, sunset replacedBy) and targeted audits pass locally. Full type-check and audits are left to CI.
Please review:
- Backward compatibility: global credentials store no cloud field, old workers fail closed on a national-cloud secret, and legacy inline ADX authorities are unchanged.
- ADX audience derivation and owner-scope re-check in requestAzureDataExplorerAsApp.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

vercel · 2026-11-12T11:50:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Nov 12, 2026 2:18pm UTC

cubic-dev-ai

All reported issues were addressed across 51 files

_{Turn on auto-fix | Re-trigger cubic}

greptile-apps · 2026-11-12T11:58:31Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable issues remain from this review.

Summary

Adds Microsoft app credentials for Power BI and a new saved-credential Azure Data Explorer block.

Microsoft app credentials can sign in through Global, US Government, or China clouds.
Power BI workflows can run with a saved Microsoft app credential.
Azure Data Explorer workflows can use a saved app credential for each cluster.

No new actionable issues were found.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Selected Microsoft app credential] --> B[Executor checks access]
  B --> C{Service}
  C -->|Power BI or Graph or Dataverse| D[Choose service audience]
  C -->|Azure Data Explorer| E[Check owner and allowed cluster hosts]
  E --> F[Choose cluster audience and clouds]
  D --> G[Look up token by credential, secret version, and audience]
  F --> G
  G -->|Cache miss| H[Decrypt and check cloud]
  H --> I[Mint token at credential cloud endpoint]
  G -->|Cache hit| J[Call service]
  I --> J

_{Reviews (4) · Last reviewed commit: "fix(credentials): resolve a reconnect's ..." · Reviewed by Greptile}

waleedlatif1 · 2026-11-12T12:41:06Z

@greptile

waleedlatif1 · 2026-11-12T12:41:07Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T12:41:11Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 51 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-11-12T13:28:34Z

@greptile

waleedlatif1 · 2026-11-12T13:28:36Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T13:28:42Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 51 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

…l national cloud Microsoft app credentials resolve each service's token audience from one table and cache minted tokens per credential, stored-secret version, and audience, so services that need a different resource no longer share a Graph-or-Dataverse key. A credential can name a national cloud (US Government GCC High or DoD, or China); its Entra endpoint, certificate assertion audience, and save-time Graph check follow that cloud. Global credentials store no cloud field, so existing secrets and older workers read them exactly as before, and Graph and Dataverse services refuse a national-cloud credential because their tools call the global cloud.

The Power BI service offers the Microsoft app credential beside its delegated OAuth connection. A run or selector with an app credential gets an app-only token for the Power BI REST API audience (https://analysis.windows.net/powerbi/api/.default), cached apart from the credential's Graph token; national-cloud credentials are refused because the tools call api.powerbi.com. Delegated connections and every tool's params are unchanged. The Power BI integration suite proves a run and a selector end to end with a persisted app credential.

Adds azure_data_explorer_v2, a credential-only successor whose picker selects a Microsoft app credential (client secret, certificate, or keyless federated credential) in place of the inline tenant ID, client ID, and client secret. The executor authorizes the credential and the operation mints a token for the cluster each call names: the audience is the allowlisted cluster (or resource override) host as https://<host>, and the credential's cloud must be one that host belongs to, so a US Government or China cluster takes a matching national-cloud credential. Inline secrets are never read on that path. The legacy block keeps its inline fields and behavior and is marked legacy with azure_data_explorer_v2 as its replacement. The connect dialog gains a Cloud choice; a global credential's payload and stored secret are unchanged.

…and scope the ADX operation - Token cache key is named before decrypting, so a cached token skips the decrypt and parse; Azure Data Explorer authorization no longer decrypts, and its cluster key includes the resource's clouds. - The ADX operation re-checks the credential against the run's workspace or organization, as the AWS operation path does. - A credential in the wrong Microsoft cloud is refused as cloud_mismatch with its own message instead of "reconnect the credential"; ADX tool errors come from the refusal code, not log detail. - The operation-minted service comes from the shared ADX credential config. - Reconnect reopens a national-cloud credential on its stored cloud. - China signs in at login.partner.microsoftonline.cn (Entra national-cloud reference) for both ADX auth paths; Kusto authorities derive from MICROSOFT_CLOUDS. - Drop the one-line ADX operations passthrough; refresh TSDoc and the Power BI description.

…r Dataverse as a cloud mismatch

…gh one per-provider map

…e a cross-cloud ADX resource A Microsoft app reconnect now waits for the stored cloud, or asks for one when it cannot be read (an organization credential or a failed lookup), instead of saving as global. The ADX schema refuses a resource override whose cloud differs from the cluster's before any credential is decrypted, and the Power BI description says app credentials run in the global cloud only.

waleedlatif1 · 2026-11-12T14:13:25Z

@greptile

waleedlatif1 · 2026-11-12T14:13:27Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-11-12T14:13:34Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 51 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread ...aceId]/integrations/components/connect-service-account-modal/microsoft-app-account-modal.tsx Resolved

Comment thread apps/sim/blocks/blocks/powerbi.ts Resolved

Comment thread apps/sim/lib/internal/azure-data-explorer/schema.ts Resolved

vercel Bot deployed to Preview November 12, 2026 11:55

View deployment

greptile-apps Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread ...aceId]/integrations/components/connect-service-account-modal/microsoft-app-account-modal.tsx Resolved

waleedlatif1 force-pushed the feat/microsoft-app-resources branch from c7a71c9 to 5e55a34 Compare November 12, 2026 12:39

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

Comment thread apps/sim/lib/oauth/oauth.ts Resolved

vercel Bot deployed to Preview November 12, 2026 12:44

View deployment

waleedlatif1 force-pushed the feat/microsoft-app-resources branch from 5e55a34 to 772c042 Compare November 12, 2026 13:28

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

vercel Bot deployed to Preview November 12, 2026 13:33

View deployment

waleedlatif1 added 7 commits November 12, 2026 06:07

fix(credentials): refuse a national-cloud Microsoft app credential fo…

14a4429

…r Dataverse as a cloud mismatch

refactor(credentials): read a reconnect's stored mode and cloud throu…

def3860

…gh one per-provider map

waleedlatif1 force-pushed the feat/microsoft-app-resources branch from 772c042 to 55199c7 Compare November 12, 2026 14:13

cubic-dev-ai Bot reviewed Nov 12, 2026

View reviewed changes

vercel Bot deployed to Preview November 12, 2026 14:18

View deployment

waleedlatif1 merged commit bcadf23 into staging Nov 12, 2026
83 checks passed

waleedlatif1 deleted the feat/microsoft-app-resources branch November 12, 2026 17:02

Conversation

waleedlatif1 commented Nov 12, 2026

Summary

Product update (if relevant)

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Nov 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

waleedlatif1 commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot commented Nov 12, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Nov 12, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

greptile-apps Bot commented Nov 12, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading