|
| 1 | +--- |
| 2 | +title: How to configure managed identities for Azure Data Explorer cluster |
| 3 | +description: Learn how to configure managed identities for Azure Data Explorer cluster. |
| 4 | +author: saguiitay |
| 5 | +ms.author: itsagui |
| 6 | +ms.reviewer: orspodek |
| 7 | +ms.service: data-explorer |
| 8 | +ms.topic: conceptual |
| 9 | +ms.date: 01/06/2020 |
| 10 | +--- |
| 11 | + |
| 12 | +# Configure managed identities for your Azure Data Explorer cluster |
| 13 | + |
| 14 | +A [managed identity from Azure Active Directory](/azure/active-directory/managed-identities-azure-resources/overview) allows your cluster to easily access other AAD-protected resources such as Azure Key Vault. The identity is managed by the Azure platform and doesn't require you to provision or rotate any secrets. This article shows you how to create a managed identity for Azure Data Explorer clusters. |
| 15 | + |
| 16 | +> [!Note] |
| 17 | +> Managed identities for Azure Data Explorer won't behave as expected if your app is migrated across subscriptions or tenants. The app will need to obtain a new identity, which can be done by disabling and re-enabling the feature using [remove an identity](#remove-an-identity). Access policies of downstream resources will also need to be updated to use the new identity. |
| 18 | +
|
| 19 | +## Add a system-assigned identity |
| 20 | + |
| 21 | +Your cluster can be assigned a **system-assigned identity** that is tied to your cluster, and is deleted if your cluster is deleted. A cluster can only have one system-assigned identity. Creating a cluster with a system-assigned identity requires an additional property to be set on the cluster. |
| 22 | + |
| 23 | +### Add a system-assigned identity using C# |
| 24 | + |
| 25 | +To set up a managed identity using the Azure Data Explorer C# client, do the following: |
| 26 | + |
| 27 | +* Install the [Azure Data Explorer (Kusto) NuGet package](https://www.nuget.org/packages/Microsoft.Azure.Management.Kusto/). |
| 28 | +* Install the [Microsoft.IdentityModel.Clients.ActiveDirectory NuGet package](https://www.nuget.org/packages/Microsoft.IdentityModel.Clients.ActiveDirectory/) for authentication. |
| 29 | +* To run the following example, [create an Azure AD application](/azure/active-directory/develop/howto-create-service-principal-portal) and service principal that can access resources. You can add role assignment at the subscription scope and get the required `Directory (tenant) ID`, `Application ID`, and `Client Secret`. |
| 30 | + |
| 31 | +#### Create or update your cluster |
| 32 | + |
| 33 | +1. Create or update your cluster using the `Identity` property: |
| 34 | + |
| 35 | + ```csharp |
| 36 | + var tenantId = "xxxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxx";//Directory (tenant) ID |
| 37 | + var clientId = "xxxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxx";//Application ID |
| 38 | + var clientSecret = "xxxxxxxxxxxxxx";//Client Secret |
| 39 | + var subscriptionId = "xxxxxxxx-xxxxx-xxxx-xxxx-xxxxxxxxx"; |
| 40 | + var authenticationContext = new AuthenticationContext($"https://login.windows.net/{tenantId}"); |
| 41 | + var credential = new ClientCredential(clientId, clientSecret); |
| 42 | + var result = await authenticationContext.AcquireTokenAsync(resource: "https://management.core.windows.net/", clientCredential: credential); |
| 43 | + |
| 44 | + var credentials = new TokenCredentials(result.AccessToken, result.AccessTokenType); |
| 45 | + |
| 46 | + var kustoManagementClient = new KustoManagementClient(credentials) |
| 47 | + { |
| 48 | + SubscriptionId = subscriptionId |
| 49 | + }; |
| 50 | + |
| 51 | + var resourceGroupName = "testrg"; |
| 52 | + var clusterName = "mykustocluster"; |
| 53 | + var location = "Central US"; |
| 54 | + var skuName = "Standard_D13_v2"; |
| 55 | + var tier = "Standard"; |
| 56 | + var capacity = 5; |
| 57 | + var sku = new AzureSku(skuName, tier, capacity); |
| 58 | + var identity = new Identity(IdentityType.SystemAssigned); |
| 59 | + var cluster = new Cluster(location, sku, identity: identity); |
| 60 | + await kustoManagementClient.Clusters.CreateOrUpdateAsync(resourceGroupName, clusterName, cluster); |
| 61 | + ``` |
| 62 | + |
| 63 | +2. Run the following command to check if your cluster was successfully created or updated with an identity: |
| 64 | + |
| 65 | + ```csharp |
| 66 | + kustoManagementClient.Clusters.Get(resourceGroupName, clusterName); |
| 67 | + ``` |
| 68 | + |
| 69 | + If the result contains `ProvisioningState` with the `Succeeded` value, then the cluster was created or updated, and should have the following properties: |
| 70 | + |
| 71 | + ```csharp |
| 72 | + var principalId = cluster.Identity.PrincipalId; |
| 73 | + var tenantId = cluster.Identity.TenantId; |
| 74 | + ``` |
| 75 | + |
| 76 | + `PrincipalId` and `TenantId` are replaced with GUIDs. The `TenantId` property identifies the AAD tenant to which the identity belongs. The `PrincipalId` is a unique identifier for the cluster's new identity. Within AAD, the service principal has the same name that you gave to your App Service or Azure Functions instance. |
| 77 | + |
| 78 | +### Add a system-assigned identity using an Azure Resource Manager template |
| 79 | + |
| 80 | +An Azure Resource Manager template can be used to automate deployment of your Azure resources. To learn more about deploying to Azure Data Explorer, see [Create an Azure Data Explorer cluster and database by using an Azure Resource Manager template](create-cluster-database-resource-manager.md). |
| 81 | + |
| 82 | +Adding the system-assigned type tells Azure to create and manage the identity for your cluster. Any resource of type `Microsoft.Kusto/clusters` can be created with an identity by including the following property in the resource definition: |
| 83 | + |
| 84 | +```json |
| 85 | +"identity": { |
| 86 | + "type": "SystemAssigned" |
| 87 | +} |
| 88 | +``` |
| 89 | + |
| 90 | +For example: |
| 91 | + |
| 92 | +```json |
| 93 | +{ |
| 94 | + "apiVersion": "2019-09-07", |
| 95 | + "type": "Microsoft.Kusto/clusters", |
| 96 | + "name": "[variables('clusterName')]", |
| 97 | + "location": "[resourceGroup().location]", |
| 98 | + "identity": { |
| 99 | + "type": "SystemAssigned" |
| 100 | + }, |
| 101 | + "properties": { |
| 102 | + "trustedExternalTenants": [], |
| 103 | + "virtualNetworkConfiguration": null, |
| 104 | + "optimizedAutoscale": null, |
| 105 | + "enableDiskEncryption": false, |
| 106 | + "enableStreamingIngest": false, |
| 107 | + } |
| 108 | +} |
| 109 | +``` |
| 110 | + |
| 111 | +When the cluster is created, it has the following additional properties: |
| 112 | + |
| 113 | +```json |
| 114 | +"identity": { |
| 115 | + "type": "SystemAssigned", |
| 116 | + "tenantId": "<TENANTID>", |
| 117 | + "principalId": "<PRINCIPALID>" |
| 118 | +} |
| 119 | +``` |
| 120 | + |
| 121 | +`<TENANTID>` and `<PRINCIPALID>` are replaced with GUIDs. The `TenantId` property identifies the AAD tenant to which the identity belongs. The `PrincipalId` is a unique identifier for the cluster's new identity. Within AAD, the service principal has the same name that you gave to your App Service or Azure Functions instance. |
| 122 | + |
| 123 | +## Remove an identity |
| 124 | + |
| 125 | +Removing a system-assigned identity will also delete it from AAD. System-assigned identities are also automatically removed from AAD when the cluster resource is deleted. A system-assigned identity can be removed by disabling the feature: |
| 126 | + |
| 127 | +```json |
| 128 | +"identity": { |
| 129 | + "type": "None" |
| 130 | +} |
| 131 | +``` |
| 132 | + |
| 133 | +## Next steps |
| 134 | + |
| 135 | +* [Secure Azure Data Explorer clusters in Azure](security.md) |
| 136 | +* [Secure your cluster in Azure Data Explorer - Azure portal](manage-cluster-security.md) by enabling encryption at rest. |
| 137 | + * [Configure customer-managed-keys using C#](customer-managed-keys-csharp.md) |
| 138 | + * [Configure customer-managed-keys using the Azure Resource Manager template](customer-managed-keys-resource-manager.md) |
0 commit comments