AME ADF unable to create Linked Service for CORP Kusto cluster

Hemant 41 Reputation points Microsoft External Staff
2026-07-06T23:40:30.3166667+00:00

Hello Team,

I am trying to create a Linked Service in AME ADF for CORP Kusto cluster. For that I have created SPN in AME and marked it as multi-tenant. This SPN is also created in CORP. However, AME ADF is throwing error that SPN USER does not have access to Kusto.

Please help with this issue. Since this required proper understanding of the issue, I would just the engineer working on this can ping me for a quick call.

Azure Data Factory
Azure Data Factory

An Azure service for ingesting, preparing, and transforming data at scale.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vinodh247-1375 43,426 Reputation points Volunteer Moderator
    2026-07-07T06:08:16.5533333+00:00

    Hi ,

    Thanks for reaching out to Microsoft Q&A.

    This is not an ADF issue; it is a cross-tenant Azure Data Explorer (Kusto) permission + token context problem.

    Your SPN being multi-tenant and existing in both AME and CORP is not sufficient. ADF authenticates in the home tenant (AME) and gets a token for Kusto, but Kusto (in CORP) will only allow access if that exact service principal (object ID from CORP tenant) is granted permissions on the cluster/database.

    What to check/fix (in order):

    • In CORP tenant -> Kusto cluster -> Permissions (IAM / db permissions), explicitly add the spn (enterprise app in CORP) and assign at least Viewer/User role (or higher as needed).
    • Ensure you are using the correct tenantID (CORP tenant) in the Linked Service, not AME.

    Verify the SPN object ID used in Kusto is from CORP tenant, not the AME app registration object ID.

    • If using database-level access, run: .add database <db> users ('aadapp=<appId>') (or via portal permissions)

    I know ADF can auth, but Kusto is denying authorization because the SPN is not granted access in the CORP tenant context. Once the SPN (enterprise app in CORP) is added to Kusto with proper role, the Linked Service will work.

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.