getredash/redash · error · ValueError

Azure AD Client ID, Client Secret, and Tenant ID are require

Error message

Azure AD Client ID, Client Secret, and Tenant ID are required for Service Principal authentication.

What it means

AzureKusto.run_query validates Service Principal mode: when auth isn't interactive/device, all of azure_ad_client_id, azure_ad_client_secret, and azure_ad_tenant_id must be present and truthy, otherwise ValueError is raised before any Kusto connection is attempted.

Source

Thrown at redash/query_runner/azure_kusto.py:141

        msi = self.configuration.get("msi", False)
        # Managed Service Identity(MSI)
        if msi:
            # If user-assigned managed identity is used, the client ID must be provided
            if self.configuration.get("user_msi"):
                kcsb = KustoConnectionStringBuilder.with_aad_managed_service_identity_authentication(
                    cluster,
                    client_id=self.configuration["user_msi"],
                )
            else:
                kcsb = KustoConnectionStringBuilder.with_aad_managed_service_identity_authentication(cluster)
        # Service Principal auth
        else:
            aad_app_id = self.configuration.get("azure_ad_client_id")
            app_key = self.configuration.get("azure_ad_client_secret")
            authority_id = self.configuration.get("azure_ad_tenant_id")

            if not (aad_app_id and app_key and authority_id):
                raise ValueError(
                    "Azure AD Client ID, Client Secret, and Tenant ID are required for Service Principal authentication."
                )

            kcsb = KustoConnectionStringBuilder.with_aad_application_key_authentication(
                connection_string=cluster,
                aad_app_id=aad_app_id,
                app_key=app_key,
                authority_id=authority_id,
            )

        client = KustoClient(kcsb)

        request_properties = ClientRequestProperties()
        request_properties.application = "redash"

        if user:
            request_properties.user = user.email
            request_properties.set_option("request_description", user.email)

View on GitHub (pinned to ca79fe988d)

Solutions

1. Fill all three fields: azure_ad_client_id, azure_ad_client_secret, azure_ad_tenant_id
2. Regenerate the client secret in Azure AD if it was rotated and paste the new value
3. Use the tenant ID GUID, not the tenant display name

Example fix

# before
{"cluster": "https://help.kusto.windows.net", "azure_ad_client_id": "<app-id>"}

# after
{"cluster": "https://help.kusto.windows.net", "azure_ad_client_id": "<app-id>", "azure_ad_client_secret": "<secret>", "azure_ad_tenant_id": "<tenant-guid>"}

keys = ['azure_ad_client_id', 'azure_ad_client_secret', 'azure_ad_tenant_id']
if not all(configuration.get(k) for k in keys):
    raise ValueError('complete the Azure AD service principal config first')

def is_complete_sp_config(config: dict) -> bool:
    return all(bool(config.get(k)) for k in ('azure_ad_client_id', 'azure_ad_client_secret', 'azure_ad_tenant_id'))

try:
    data, err = runner.run_query(q, u)
except ValueError as e:
    if 'Service Principal' in str(e):
        collect_missing_azure_fields(); update_data_source(); retry

When it happens

Trigger: Configuring an Azure Data Explorer source with service-principal auth but leaving any of Client ID, Client Secret, or Tenant ID blank in the configuration JSON.

Common situations: Secret rotated and left blank, copy-pasting only the App ID from the Azure portal, or env-var indirection resolving to empty strings.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Username and Password required
• Neither password nor private_key_b64 is set.
• Invalid JWT token
• MongoDB connection error
• Failed describing objects.

AI-assisted analysis of getredash/redash@ca79fe988d (2026-08-28). Data as JSON: /api/errors/90e3427aa5972d79. Report an issue: GitHub.