Azure Data Explorer
Connecting an Azure Data Explorer (Kusto) cluster to NeuBird lets investigations query that cluster’s log and telemetry data directly. Each connection addresses one cluster by its data-plane URI — add a separate connection for each cluster you want NeuBird to query, even if they share the same Azure AD app.
NeuBird authenticates to the cluster using an Azure AD (Entra ID) service principal, either with a client secret or with workload identity federation.
Step 1: Register an Azure AD application
Section titled “Step 1: Register an Azure AD application”- Sign in to the Azure Portal and open Microsoft Entra ID > App registrations > New registration.
- Give the application a name (for example,
NeuBird) and click Register. - From the app’s Overview page, copy the Application (client) ID and Directory (tenant) ID.
Step 2: Create a client secret (unless using workload identity)
Section titled “Step 2: Create a client secret (unless using workload identity)”- On the app’s Certificates & secrets page, click Client secrets > New client secret.
- Add a description and expiry, then click Add.
- Copy the secret’s Value immediately — it is not shown again.
Step 3: Grant the service principal access to the cluster
Section titled “Step 3: Grant the service principal access to the cluster”Run the following in the Kusto Web UI (or via the KQL client) against the target database, granting the app at least Viewer access:
.add database <DatabaseName> viewers ('aadapp=<ClientID>;<TenantID>')Note
If you’d rather not manage a client secret, enable Use Workload Identity on the connection instead. This authenticates via workload identity federation and leaves the Client Secret field blank — the cluster-access grant in Step 3 is still required either way.
Connection Fields
Section titled “Connection Fields”| Field | Required | Description |
|---|---|---|
| Name | Yes | A descriptive name for this connection |
| Description | No | An overview of what this connection is used for |
| Cluster URI | Yes | The cluster’s data-plane URI, e.g. https://mycluster.westus2.kusto.windows.net |
| Tenant ID | Yes | The Entra tenant ID the cluster’s authentication goes through |
| Client ID | Yes | The Application (client) ID from Step 1 |
| Use Workload Identity | No | Authenticate with workload identity federation instead of a client secret |
| Client Secret | Required unless workload identity is enabled | The client secret from Step 2 |
For general instructions on creating and managing connections, see the Connections Overview.