Skip to content

feat(credentials): Microsoft app credentials for Power BI and Azure Data Explorer, with national clouds #9931

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waleedlatif1 merged 7 commits into from
Nov 12, 2026
Merged

feat(credentials): Microsoft app credentials for Power BI and Azure Data Explorer, with national clouds #9931

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a1575d2
feat(credentials): resource-aware Microsoft app tokens and an optiona…
waleedlatif1 Nov 12, 2026
1cff484
feat(powerbi): run Power BI as a Microsoft app credential
waleedlatif1 Nov 12, 2026
50a927d
feat(azure-data-explorer): run as a saved Microsoft app credential
waleedlatif1 Nov 12, 2026
d4c519d
fix(credentials): decrypt Microsoft app secrets only on a token miss …
waleedlatif1 Nov 12, 2026
14a4429
fix(credentials): refuse a national-cloud Microsoft app credential fo…
waleedlatif1 Nov 12, 2026
def3860
refactor(credentials): read a reconnect's stored mode and cloud throu…
waleedlatif1 Nov 12, 2026
55199c7
fix(credentials): resolve a reconnect's cloud before saving and refus…
waleedlatif1 Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions apps/docs/components/ui/icon-mapping.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,6 +361,7 @@ export const blockTypeToIconMap: Record<string, IconComponent> = {
athena_v2: AthenaIcon,
attio: AttioIcon,
azure_data_explorer: AzureDataExplorerIcon,
azure_data_explorer_v2: AzureDataExplorerIcon,
azure_devops: AzureIcon,
azure_devops_v2: AzureIcon,
bitbucket: BitbucketIcon,
Expand Down
48 changes: 3 additions & 45 deletions apps/docs/content/docs/integrations/azure_data_explorer.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
title: Azure Data Explorer
description: Query and manage Azure Data Explorer (Kusto) clusters with KQL
integration:
type: "azure_data_explorer"
type: "azure_data_explorer_v2"
color: "#FFFFFF"
---

Expand Down Expand Up @@ -32,7 +32,7 @@ In Sim, this integration gives your agents both halves:
- **Debug the pipeline** — list ingestion failures with their error codes and root causes, and check the state of a long-running operation
- **Run any management command** — the escape hatch for policies, mappings, and anything else on the control plane

Authentication uses a **Microsoft Entra service principal** (an app registration with a tenant ID, client ID, and client secret) rather than an interactive sign-in, so scheduled and unattended workflows keep working without anyone logging in. Grant that principal access to the database with `.add database <DATABASE> viewers ('aadapp=<clientId>;<tenantId>')` — use `viewers` for read-only agents, and `ingestors` or `users` only when a workflow needs to write.
Authentication uses a **Microsoft Entra app registration** rather than an interactive sign-in, so scheduled and unattended workflows keep working without anyone logging in. Select a saved [Microsoft app credential](/integrations/microsoft-app-credentials), which signs in with a client secret, a certificate, or a keyless federated credential; choose the credential's cloud to match the cluster (a `kusto.usgovcloudapi.net` cluster needs a US Government credential, a `kusto.chinacloudapi.cn` one a China credential). Sim mints a token for the cluster itself (`https://<cluster host>`) on each run. Grant the app access to the database with `.add database <DATABASE> viewers ('aadapp=<clientId>;<tenantId>')` — use `viewers` for read-only agents, and `ingestors` or `users` only when a workflow needs to write. Workflows built before saved credentials keep their inline tenant ID, client ID, and client secret.

A few things worth knowing before you build:

Expand All @@ -46,7 +46,7 @@ A few things worth knowing before you build:

## Use the block [#usage-instructions]

Run Kusto Query Language queries against Azure Data Explorer and Fabric Eventhouse clusters, discover databases, tables, and schemas, push small batches of rows inline, and run management commands. Authenticates with a Microsoft Entra service principal using client credentials, so no interactive sign-in is needed.
Run Kusto Query Language queries against Azure Data Explorer and Fabric Eventhouse clusters, discover databases, tables, and schemas, push small batches of rows inline, and run management commands. Runs as a Microsoft app credential: an app registration signing in with a client secret, a certificate, or a keyless federated credential, in the global cloud or a national cloud, so no interactive sign-in is needed.

## Actions

Expand All @@ -61,9 +61,6 @@ Run a Kusto Query Language (KQL) query against an Azure Data Explorer database a
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database to run the query against |
| `query` | string | Yes | KQL query text \(e.g., StormEvents \| where State == "FLORIDA" \| summarize count\(\) by EventType\) |
Expand Down Expand Up @@ -98,9 +95,6 @@ Run an Azure Data Explorer management command (a control command starting with "
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `command` | string | Yes | Management command text, starting with "." \(e.g., .show table Events details\) |
| `database` | string | No | Database context for the command. Required for all commands except cluster-level ones such as .show databases |
Expand Down Expand Up @@ -133,9 +127,6 @@ List the databases on an Azure Data Explorer cluster that the service principal
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |

#### Output
Expand Down Expand Up @@ -167,9 +158,6 @@ List the tables in an Azure Data Explorer database, with their folder and docstr
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database whose tables should be listed |

Expand Down Expand Up @@ -202,9 +190,6 @@ Read the column schema of an Azure Data Explorer table in CSL form (e.g., "Times
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database containing the table |
| `table` | string | Yes | Table whose schema should be read |
Expand Down Expand Up @@ -232,9 +217,6 @@ Read the full schema of an Azure Data Explorer database as a flat list of every
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database whose schema should be read |

Expand Down Expand Up @@ -266,9 +248,6 @@ Read size, row count, hot-cache footprint, and effective policies for a table
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database to read table details from |
| `table` | string | No | Table to describe. Omit to describe every table in the database |
Expand Down Expand Up @@ -301,9 +280,6 @@ List the stored functions in an Azure Data Explorer database, with their paramet
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database whose stored functions should be listed |

Expand Down Expand Up @@ -336,9 +312,6 @@ Push rows directly into an Azure Data Explorer table with .ingest inline. Data i
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database containing the target table |
| `table` | string | Yes | Table to ingest into. Its schema is the assumed schema for the data |
Expand Down Expand Up @@ -374,9 +347,6 @@ Materialize the result of a KQL query into a table with .set, .append, .set-or-a
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database containing the target table |
| `table` | string | Yes | Table to ingest the query result into |
Expand Down Expand Up @@ -413,9 +383,6 @@ Create a table in an Azure Data Explorer database from a CSL column schema. Succ
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database to create the table in |
| `table` | string | Yes | Name of the table to create |
Expand Down Expand Up @@ -450,9 +417,6 @@ Drop a table from an Azure Data Explorer database. The table becomes unavailable
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database containing the table |
| `table` | string | Yes | Name of the table to drop |
Expand Down Expand Up @@ -487,9 +451,6 @@ List ingestion failures recorded for a database, with the failing table, error c
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | Yes | Database whose ingestion failures should be listed |
| `operationId` | string | No | Limit results to a single ingestion operation ID |
Expand Down Expand Up @@ -522,9 +483,6 @@ Check the state of administrative operations on a cluster, such as an async inge
| Parameter | Type | Required | Description |
| --------- | ---- | -------- | ----------- |
| `clusterUri` | string | Yes | Cluster URI \(e.g., https://mycluster.eastus.kusto.windows.net) |
| `tenantId` | string | Yes | Microsoft Entra tenant ID hosting the service principal |
| `clientId` | string | Yes | Microsoft Entra application \(client\) ID |
| `clientSecret` | string | Yes | Microsoft Entra application client secret |
| `resource` | string | No | Token audience override. Defaults to the cluster URI itself |
| `database` | string | No | Database context for the command |
| `operationId` | string | No | Operation ID to check, e.g. the ID returned by an async ingestion |
Expand Down
Loading
Loading