Kusto connection strings

Several Kusto client tools support an extension over the URI prefix of the connection string that allows for a shorthand format of @ClusterName/InitialCatalog. For example, these tools translate the connection string @help/Samples to https://help.chinaeast2.kusto.chinacloudapi.cn/Samples; Fed=true.

Microsoft Entra ID federated authentication with current user identity

The following example shows how to set up a connection to a Kusto service using Microsoft Entra ID for federated authentication. The user is prompted for credentials, when necessary.

var kustoUri = "https://<clusterName>.<region>.kusto.chinacloudapi.cn";
var authority = "contoso.com"; // Or the AAD tenant GUID
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
    .WithAadUserPromptAuthentication(authority);
// Equivalent Kusto connection string: $"Data Source={kustoUri};Database=NetDefaultDB;Fed=True;Authority Id={authority}"

Microsoft Entra ID federated authentication with user ID hint

The following example shows how to set up a connection to a Kusto service using Microsoft Entra ID for federated authentication and prefills the user's identity using the userID variable. The user is prompted for credentials, when necessary.

var kustoUri = "https://<clusterName>.<region>.kusto.chinacloudapi.cn";
var authority = "contoso.com"; // Or the AAD tenant GUID
var userId = "johndoe@contoso.com";
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
  .WithAadUserPromptAuthentication(authority, userId);
// Equivalent Kusto connection string: $"Data Source={kustoUri};Database=NetDefaultDB;Fed=True;Authority Id={authority};User ID={userId}"

Microsoft Entra ID federated application authentication with ApplicationClientId and ApplicationKey

The following example shows how to authenticate to a Kusto service using Microsoft Entra ID for federated authentication with an application client ID and key.

var kustoUri = "https://<clusterName>.<region>.kusto.chinacloudapi.cn";
var appId = "<appId>";
var appKey = "<appKey>";
var authority = "contoso.com"; // Or the AAD tenant GUID
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
    .WithAadApplicationKeyAuthentication(appId, appKey, authority);
// Equivalent Kusto connection string: $"Data Source={kustoUri};Database=NetDefaultDB;Fed=True;AppClientId={appId};AppKey={appKey};Authority Id={authority}"

Authenticate with a system-assigned Managed Identity

The following example shows how to authenticate to a Kusto service using a system-assigned Managed Identity for authentication.

var kustoUri = "https://<clusterName>.<region>.kusto.chinacloudapi.cn";
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
    .WithAadSystemManagedIdentity();

Authenticate with a user-assigned Managed Identity

The following example shows how to authenticate to a Kusto service using a user-assigned Managed Identity for authentication.

var kustoUri = "https://<clusterName>.<region>.kusto.chinacloudapi.cn";
var managedIdentityClientId = "<managedIdentityClientId>";
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
    .WithAadUserManagedIdentity(managedIdentityClientId);

Microsoft Entra ID federated authentication with user and application tokens

The following example shows how to set up a connection to a Kusto service using Microsoft Entra ID with either a user access token or an application access token.

var kustoUri = "https://<clusterName>.<region>.kusto.chinacloudapi.cn";
var userAccessToken = "<userAccessToken>";
var appAccessToken = "<appAccessToken>";
// AAD User token
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
    .WithAadUserTokenAuthentication(userAccessToken);

// Equivalent Kusto connection string: "Data Source={kustoUri};Database=NetDefaultDB;Fed=True;UserToken={userAccessToken}"
// AAD Application token
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
    .WithAadApplicationTokenAuthentication(appAccessToken);

// Equivalent Kusto connection string: "Data Source={kustoUri};Database=NetDefaultDB;Fed=True;ApplicationToken={appAccessToken}"

Authentication with token provider callback

The following example shows how to authenticate to a Kusto service using Microsoft Entra ID with a custom token provider callback. The token is invoked each time a token is required.

var kustoUri = "https://<clusterName>.<region>.kusto.chinacloudapi.cn";
Func<string> tokenProviderCallback; // User-defined method to retrieve the access token
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
    .WithAadTokenProviderAuthentication(tokenProviderCallback);

Authentication with X.509 certificate

The following example shows how to authenticate to a Kusto service using Microsoft Entra ID for federated authentication with an application certificate.

var kustoUri = "https://<clusterName>.<region>.kusto.chinacloudapi.cn";
var appId = "<appId>";
X509Certificate2 appCert;
var authority = "contoso.com"; // Or the AAD tenant GUID
bool sendX5c; // Set to 'True' to use Trusted Issuer feature of AAD
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
    .WithAadApplicationCertificateAuthentication(appId, appCert, authority, sendX5c);

Authentication with X.509 certificate thumbprint

The following example shows how to set up a connection to a Kusto service using Microsoft Entra ID with an application certificate thumbprint. The client attempts to load the certificate from a local store.

var kustoUri = "https://<clusterName>.<region>.kusto.chinacloudapi.cn";
var appId = "<appId>";
var appCert = "<appCert>";
var authority = "contoso.com"; // Or the AAD tenant GUID
var kustoConnectionStringBuilder = new KustoConnectionStringBuilder(kustoUri)
    .WithAadApplicationThumbprintAuthentication(appId, appCert, authority);
// Equivalent Kusto connection string: $"Data Source={kustoUri};Database=NetDefaultDB;Fed=True;AppClientId={appId};AppCert={appCert};Authority Id={authority}"