Edit

Connect to Azure Data Explorer (Kusto) through Azure MCP

In this tutorial, you connect your SRE agent to Azure Data Explorer (Kusto) by using the Azure MCP Kusto path. The connector wizard creates the Azure MCP Kusto parent connector, lets you add Kusto cluster groups, and tests cluster connectivity before saving.

Use this article for new Azure Data Explorer connections. The standard connector picker no longer uses the legacy Azure Data Explorer card for new connectors.

Estimated time: 15 minutes

In this tutorial, you learn how to:

  • Locate your Azure Data Explorer cluster URL and database name
  • Grant the agent's managed identity access to the database
  • Add Azure Data Explorer through the Telemetry tab
  • Configure Kusto cluster groups for Azure MCP
  • Test per-cluster connectivity and save the connector

Prerequisites

  • An existing Azure Data Explorer cluster
  • Admin access to grant database permissions on the target cluster
  • An agent created in the SRE Agent portal with a managed identity (system-assigned or user-assigned)

Get your cluster details

To configure the connector, you need the cluster URL and at least one database name.

  1. Find your cluster URL. The URL follows this format:

    https://<CLUSTER_NAME>.<REGION>.kusto.windows.net

  2. Note the name of the database you want the agent to query. You'll need the full URL in the format https://<CLUSTER_NAME>.<REGION>.kusto.windows.net/<DATABASE_NAME>.

Grant the agent database permissions

The managed identity that runs Kusto queries needs at least viewer-level access to the database. Use the connector-level managed identity, or the group-level managed identity if you assign a different identity to a cluster group.

Run the following KQL command to grant the required permissions:

.add database <DATABASE_NAME> viewers ('aadapp=<AGENT_MANAGED_IDENTITY_ID>')

Replace <DATABASE_NAME> with your database name and <AGENT_MANAGED_IDENTITY_ID> with the managed identity client ID.

Add the connector in the portal

Configure Azure Data Explorer in the SRE Agent portal.

  1. Go to Builder > Connectors.
  2. Select Add connector.
  3. Select the Telemetry tab.
  4. Select the Azure Data Explorer card. This card uses the Azure MCP Kusto path.
  5. Select Next.

Set up the connector

  1. Enter a Name for the connector, such as "production-logs".
  2. Select a Managed identity from the dropdown. This identity is the default for Kusto cluster groups unless a group uses a different identity.
  3. Select Next.

Add cluster groups

Cluster groups let you organize Kusto clusters that share the same schema or managed identity.

  1. Select Create new group.
  2. Enter a Group name, such as "production".
  3. Select a Managed identity for this cluster group, or leave it as (inherit) to use the connector-level identity.
  4. Under Clusters, enter your cluster URL in the format https://<CLUSTER_NAME>.<REGION>.kusto.windows.net/<DATABASE_NAME>.
  5. To add more clusters to the same group, type each URL in the next row. A new row appears automatically when you fill the current one.
  6. To add another group with different clusters or a different identity, select Create new group again.
  7. Select Next.

Review, test, and save

  1. Review your connector details: connector type, name, managed identity, and cluster groups.
  2. Decide whether the Kusto connector should be visible to the meta agent.
  3. Each cluster group shows a Not tested label.
  4. Select Test connection. The button changes to Testing connection... while connectivity is verified.
  5. After testing completes, each cluster shows a result:
    • A Connected badge means the cluster is reachable.
    • A Failed badge means the cluster is unreachable. Select See details to view the error.
  6. Once testing completes, select Add connector to save.

Tip

If a cluster fails the test, go back to verify the cluster URL format and that the managed identity has the correct permissions on that cluster.

Edit an existing connector

To modify an existing Azure Data Explorer connector, select the connector name or the edit icon in the Connectors list. The wizard opens with the Azure MCP Kusto configuration so you can update the connector details, cluster groups, and visibility setting.

Verify the connection

Confirm the agent can access the cluster by asking it a question that requires querying the database.

Ask your agent:

List the tables in the production-logs database

The agent uses the Azure MCP Kusto tools and returns a list of tables from the connected database.

Troubleshoot common issues

If you encounter problems during setup, review the following common causes.

Connection test fails with a permission error

  • Verify the managed identity has the viewer role on the target database by running .show database <DATABASE_NAME> principals.
  • Ensure you used the correct managed identity client ID when granting permissions.

Connection test fails with an unreachable error

  • Verify the cluster URL is correct and includes the region and database name.
  • Check that your firewall rules allow connections from SRE Agent IP addresses. For the list of required IP addresses, see Network requirements.

Not tested badge remains after clicking Test connection

  • Wait for the test to complete. Large clusters might take a few seconds to respond.

Next step

Diagnose with external observability

Related content

  • Last updated on