How can I authenticate against ADXProxy using app key authentication?

Question

I am trying to access an Azure Application Insights resource via Redash, using the (preview) ADXProxy feature.

I've created an App Registration in Azure, and I've got some proof-of-concept python code which can successfully access my Application Insights resource and execute a Kusto query (traces | take 1) using an application token:

import azure.kusto
import azure.kusto.data.request
import msal

cluster = 'https://ade.applicationinsights.io/subscriptions/<MY_SUBSCRIPTION>/resourcegroups/<MY_RESOURCE_GROUP>/providers/microsoft.insights/components/<MY_APP_INSIGHTS_RESOURCE>'
app_id = '<MY_APP_ID>'
app_key = '<MY_SECRET>'
authority_id = '<MY_AAD_SUBSCRIPTION_ID>'

def run():

    app = msal.ConfidentialClientApplication(
        client_id=app_id, 
        client_credential=app_key, 
        authority='https://login.microsoftonline.com/<MY_AAD_SUBSCRIPTION_ID>')

    token = app.acquire_token_for_client(['https://help.kusto.windows.net/.default'])

    kcsb = azure.kusto.data.request.KustoConnectionStringBuilder.with_aad_application_token_authentication(
        connection_string=cluster,
        application_token=token['access_token']
    )

    client = azure.kusto.data.request.KustoClient(kcsb)

    result = client.execute('<MY_APP_INSIGHTS_RESOURCE>', 'traces | take 1')

    for res in result.primary_results:
        print(res)

    return 1

if __name__ == "__main__":
    run()

However, Redash doesn't support application token authentication: it uses application key authentication, making a call like:

    kcsb = azure.kusto.data.request.KustoConnectionStringBuilder.with_aad_application_key_authentication(
        connection_string = cluster,
        aad_app_id = app_id,
        app_key = app_key,
        authority_id = '<MY_AAD_SUBSCRIPTION_ID>'
    )

I can't successfully connect to my App Insights resource using this type of flow. If I substitute this KustoConnectionStringBuilder into my program above, I get an exception telling me:

The resource principal named https://ade.applicationinsights.io was not found in the tenant named <MY_AAD_SUBSCRIPTION_ID>. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.

Is there something I can do in code or Azure Portal configuration to connect my 'tenant' to the ade.applicationinsights.io resource principal and get this connection working?

Answer 1

Adxproxy supports only tokens minted by Azure Active Directory (AAD). The token must be created for an Azure Data Explorer cluster (ADX), that you own. If you don't have your own ADX cluster, and for whatever reason you want to access your Application Insights resources via Adxproxy, you can always authenticate to 'https://help.kusto.windows.net' and use that token.