I would like to replace my current KustoClient that uses AAD with app secret to use Synapse Managed Identity, I am aware there is an option using linked service to read from the Kusto cluster, but I would like to reuse as much as the code that I already have using the KustoClient that I use to execute 'export' command, is there any available option using msparkutils credentials or DefaultAzureCredential from Azure Identity??
Here is how I am creating the Kusto Client right now:
kcsb = KustoConnectionStringBuilder.with_aad_application_key_authentication(kusto_cluster
, service_principal_id, service_principal_secret, tenant_id)
How to Create a Kusto Client Using Synapse Managed Identity
To authenticate with a managed identity with KustoClient
, you can follow this document.
Note: Managed identities are only effective on hosts to which they are associated when they are running in Azure.
You can use the code below to use the managed identity to authenticate with the Kusto client.
Code:
from azure.kusto.data import KustoClient, KustoConnectionStringBuilder
from azure.kusto.data.helpers import dataframe_from_result_table
cluster = "https://xxxx.eastus.kusto.windows.net"
user_assigned_managed_identity="068768d7-cxxxxx-dd4f6a0c3189"
kcsb = KustoConnectionStringBuilder.with_aad_managed_service_identity_authentication(cluster, client_id=user_assigned_managed_identity)
client = KustoClient(kcsb)
db = "database456"
query = """
StormEvents
| summarize count() by EventType
| top 5 by count_
"""
response = client.execute(db, query)
df = dataframe_from_result_table(response.primary_results[0])
print(df)
Output:
EventType count_
0 Thunderstorm Wind 13015
1 Hail 12711
2 Flash Flood 3688
3 Drought 3616
4 Winter Weather 3349
Make sure your managed identity is assigned to Data Explorer with proper permissions.
Portal:
Reference: azure - Authenticate to Kusto using managed identities in Python - Stack Overflow by Yochai Gilad.