{"record":{"id":"90e3427aa5972d79","repo":"getredash/redash","slug":"azure-ad-client-id-client-secret-and-tenant-id-a","errorCode":null,"errorMessage":"Azure AD Client ID, Client Secret, and Tenant ID are required for Service Principal authentication.","messagePattern":"Azure AD Client ID, Client Secret, and Tenant ID are required for Service Principal authentication\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"redash/query_runner/azure_kusto.py","lineNumber":141,"sourceCode":"        msi = self.configuration.get(\"msi\", False)\n        # Managed Service Identity(MSI)\n        if msi:\n            # If user-assigned managed identity is used, the client ID must be provided\n            if self.configuration.get(\"user_msi\"):\n                kcsb = KustoConnectionStringBuilder.with_aad_managed_service_identity_authentication(\n                    cluster,\n                    client_id=self.configuration[\"user_msi\"],\n                )\n            else:\n                kcsb = KustoConnectionStringBuilder.with_aad_managed_service_identity_authentication(cluster)\n        # Service Principal auth\n        else:\n            aad_app_id = self.configuration.get(\"azure_ad_client_id\")\n            app_key = self.configuration.get(\"azure_ad_client_secret\")\n            authority_id = self.configuration.get(\"azure_ad_tenant_id\")\n\n            if not (aad_app_id and app_key and authority_id):\n                raise ValueError(\n                    \"Azure AD Client ID, Client Secret, and Tenant ID are required for Service Principal authentication.\"\n                )\n\n            kcsb = KustoConnectionStringBuilder.with_aad_application_key_authentication(\n                connection_string=cluster,\n                aad_app_id=aad_app_id,\n                app_key=app_key,\n                authority_id=authority_id,\n            )\n\n        client = KustoClient(kcsb)\n\n        request_properties = ClientRequestProperties()\n        request_properties.application = \"redash\"\n\n        if user:\n            request_properties.user = user.email\n            request_properties.set_option(\"request_description\", user.email)","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/getredash/redash/blob/ca79fe988d81cdac9675b412f3dfcab107bc1fbc/redash/query_runner/azure_kusto.py#L123-L159","documentation":"AzureKusto.run_query validates Service Principal mode: when auth isn't interactive/device, all of azure_ad_client_id, azure_ad_client_secret, and azure_ad_tenant_id must be present and truthy, otherwise ValueError is raised before any Kusto connection is attempted.","triggerScenarios":"Configuring an Azure Data Explorer source with service-principal auth but leaving any of Client ID, Client Secret, or Tenant ID blank in the configuration JSON.","commonSituations":"Secret rotated and left blank, copy-pasting only the App ID from the Azure portal, or env-var indirection resolving to empty strings.","solutions":["Fill all three fields: azure_ad_client_id, azure_ad_client_secret, azure_ad_tenant_id","Regenerate the client secret in Azure AD if it was rotated and paste the new value","Use the tenant ID GUID, not the tenant display name"],"exampleFix":"# before\n{\"cluster\": \"https://help.kusto.windows.net\", \"azure_ad_client_id\": \"<app-id>\"}\n\n# after\n{\"cluster\": \"https://help.kusto.windows.net\", \"azure_ad_client_id\": \"<app-id>\", \"azure_ad_client_secret\": \"<secret>\", \"azure_ad_tenant_id\": \"<tenant-guid>\"}","handlingStrategy":"validation","validationCode":"keys = ['azure_ad_client_id', 'azure_ad_client_secret', 'azure_ad_tenant_id']\nif not all(configuration.get(k) for k in keys):\n    raise ValueError('complete the Azure AD service principal config first')","typeGuard":"def is_complete_sp_config(config: dict) -> bool:\n    return all(bool(config.get(k)) for k in ('azure_ad_client_id', 'azure_ad_client_secret', 'azure_ad_tenant_id'))","tryCatchPattern":"try:\n    data, err = runner.run_query(q, u)\nexcept ValueError as e:\n    if 'Service Principal' in str(e):\n        collect_missing_azure_fields(); update_data_source(); retry","preventionTips":["Collect all three values from the Azure AD App Registration before saving","Store secrets in a vault and fail provisioning if empty","Rotate and sync client secrets before expiry"],"tags":["redash","azure-kusto","authentication","configuration"],"backgroundTag":"missing-credentials","analyzedSha":"ca79fe988d81cdac9675b412f3dfcab107bc1fbc","analyzedAt":"2026-08-28T18:32:34.637Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}