Cross-tenant data connection

When you need to create a data connection for an Azure Event Hubs or Azure Event Grid service in a different tenant, use our API to build the connection.

In the following example, you'll use PowerShell to create a cross-tenant Event Hubs data connection and auxiliary tokens to authenticate.

• If you don't have an Azure subscription, create a Azure account before you begin.
• Create an event hub with data for ingestion with an account in Tenant1, acc1@domain1.com.
• Create a test cluster and database, with an account in Tenant2, acc2@domain2.com.

1. In the Azure portal, browse to your Event Hubs namespace.

2. In the left menu, select Access control (IAM) > Add role assignments

   

3. In the Add role assignment window, fill out the following information, and then select Save.

   

   Expand table

   Setting	Suggested value
   Role	Azure Event Hubs Data Owner
   Assign access to	User, group, or service principal
   Select	The email address of the user in Tenant2

4. When you receive an email invite on the selected address (acc2@domain2.com account), accept the invitation.

Before you begin, you'll need the Get-AzCachedAccessToken function to get the access token for Tenant1. The source code for the function can be found in the PowerShell gallery. You can include this code in your personal PowerShell profile to make it easier to call, or you can run it and then use it in these steps.

1. Run the following command to connect to Tenant1:

   Connect-AzAccount -Environment AzureChinaCloud
   

2. Add a variable with the token for Tenant1:

   $tokenfromtenant1 = Get-AzCachedAccessToken
   

3. Add an auxiliary token variable for Tenant1:

   $auxpat="Bearer $tokenfromtenant1"
   

4. Grant acc1@domain1.com access to the cluster.

5. Set the cluster's subscription ID:

   Set-AzContext -SubscriptionId "<subscription ID>"
   

6. Add a variable with the token for Tenant2:

   $tokenfromtenant2 = Get-AzCachedAccessToken
   

7. Add a pat variable to be used as the primary token:

   $pat="Bearer $tokenfromtenant2"
   

8. Add an HTTP body request variable to use when invoking the web request:

   $requestbody ='{"location": "China East 2","kind": "EventHub","properties": { "eventHubResourceId": "/subscriptions/<subscription ID>/resourceGroups/<resource group name>/providers/Microsoft.EventHub/namespaces/<event hub namespace name>/eventhubs/<event hub name>","consumerGroup": "$Default","dataFormat": "JSON", "tableName": "<ADX table name>", "mappingRuleName": "<ADX table mapping name>"}}'
   

9. Add a URI variable to use when invoking the web request:

   $adxdcuri="https://management.chinacloudapi.cn/subscriptions/<subscription ID>/resourceGroups/<resource group name>/providers/Microsoft.Kusto/clusters/<adx cluster name>/databases/<adx db name>/dataconnections/<adx data connection name>?api-version=2020-02-15"
   

10. Add acc1@domain1.com as a contributor in the cluster.

11. Invoke the following web request that uses the previously defined variables.

    Invoke-WebRequest -Headers @{Authorization = $pat; 'x-ms-authorization-auxiliary' = $auxpat} -Uri $adxdcuri -Body $requestbody -Method PUT -ContentType 'application/json'
    

You should now be able to see the newly created data connection in the Azure portal.

• Query data in Azure Data Explorer