Forum Discussion

Zicozen's avatar
Zicozen
New Member
7 months ago
Solved

Connecting to Azure Log Analytics for my Fabric Notebook

I am trying to read the data from Azure Log Analytics from a Fabric Notebook

The fabric workspace identity is created and service principal that gets created in Entra Id has been given Log Reader access to Log Analytics. However, when I run the code

Below is my notebook code...

from azure.core.credentials import AccessToken
from azure.monitor.query import LogsQueryClient
from notebookutils import credentials # Native Fabric utility
from datetime import timedelta
import pandas as pd

class FabricCredentialAdapter:
    def get_token(self, *scopes, **kwargs):
        # Scope for Log Analytics/Azure Monitor
        scope = "https://monitor.azure.com/.default"
        # Fetch the token using Fabric's internal identity bridge
        token_str = credentials.getToken(scope)
        # Return as the AccessToken object the SDK expects
        return AccessToken(token_str, 3600)

# Initialize the client with the custom adapter
client = LogsQueryClient(credential=FabricCredentialAdapter())

kql_query = """
SigninLogs
| where TimeGenerated >= ago(7d)
| where AppDisplayName == "Windows Sign In"
| where isnotempty(IPAddress) and IPAddress startswith "185.192.159."
| project
    TimeGenerated,
    UserPrincipalName,
    AppDisplayName,
    IPAddress,
    Location = tostring(LocationDetails.city),
    Country = tostring(LocationDetails.countryOrRegion),
    Device = tostring(DeviceDetail.displayName),
    OS = tostring(DeviceDetail.operatingSystem),
    Browser = tostring(DeviceDetail.browser),
    StatusCode = tostring(Status.errorCode),
    StatusReason = tostring(Status.failureReason),
    ConditionalAccessStatus
"""

response = client.query_workspace(
    workspace_id="5a66b300-5e65-43ff-87e0-118337a7bf8f",
    # query="AzureActivity | take 10",
    query=kql_query,
     timespan=timedelta(days=7)
)

if response.tables:
    import pandas as pd
    df = pd.DataFrame(response.tables[0].rows, columns=response.tables[0].columns)
    display(df)

 

And I am getting the following error...

Py4JJavaError: An error occurred while calling z:mssparkutils.credentials.getToken. : java.io.IOException: 500 {"code":"INTERNAL_ERROR","subCode":0,"message":"An internal error occurred.","timeStamp":"2026-01-26T11:33:45.5084799Z","httpStatusCode":500,"hresult":-2147467259,"details":[{"code":"RootActivityId","message":"c21253f2-0364-446d-8ce6-51298e132c19"},{"code":"Category","message":"System"},{"code":"Source","message":"TM"}]} [BEGIN_IMPULSE_EXCEPTION] [ImpulseErrorCode:Spark_System_TM_INTERNAL_ERROR] [TSGCode:] [Retriable:true] [END_IMPULSE_EXCEPTION] at com.microsoft.azure.trident.tokenlibrary.TokenLibrary.getAccessToken(TokenLibrary.scala:530) at com.microsoft.azure.trident.tokenlibrary.TokenLibrary.getAccessToken(TokenLibrary.scala:448) at com.microsoft.azure.trident.tokenlibrary.TokenLibrary$.getAccessToken(TokenLibrary.scala:1311) at mssparkutils.credentials$.getToken(credentials.scala:41) at mssparkutils.credentials.getToken(credentials.scala) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244) at py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:374) at py4j.Gateway.invoke(Gateway.java:282) at py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132) at py4j.commands.CallCommand.execute(CallCommand.java:79) at py4j.GatewayConnection.run(GatewayConnection.java:238) at java.base/java.lang.Thread.run(Thread.java:829)

Any ideas..? Is it possible to read the data in the Azure Log Analytics from a Fabric Notebook...?

Thanks for your help in advance

Tobi

 

  • Hi Zicozen 

     

    You can't use Workspace Identity to authenticate to Azure Log Analytics - already covered in another thread. 

    Fabric workspace identities cannot currently acquire tokens for the Azure Monitor (Log Analytics) resource provider.

     

    Solved: Re: Unable to Use Managed Identity Authentication ... - Microsoft Fabric Community

     

     You can however use a service principal (Azure AD App Registration) and use the code below -

     

    from azure.identity import ClientSecretCredential
    from azure.monitor.query import LogsQueryClient
    from datetime import timedelta
    import pandas as pd
    
    tenant_id = "<TENANT-ID>"
    client_id = "<CLIENT-ID>"
    client_secret = "<CLIENT-SECRET>"
    
    credential = ClientSecretCredential(
        tenant_id=tenant_id,
        client_id=client_id,
        client_secret=client_secret
    )
    
    client = LogsQueryClient(credential)
    
    kql_query = """
    SigninLogs
    | where TimeGenerated >= ago(7d)
    | where AppDisplayName == "Windows Sign In"
    """

     

2 Replies

  • Hi Zicozen 

     

    You can't use Workspace Identity to authenticate to Azure Log Analytics - already covered in another thread. 

    Fabric workspace identities cannot currently acquire tokens for the Azure Monitor (Log Analytics) resource provider.

     

    Solved: Re: Unable to Use Managed Identity Authentication ... - Microsoft Fabric Community

     

     You can however use a service principal (Azure AD App Registration) and use the code below -

     

    from azure.identity import ClientSecretCredential
    from azure.monitor.query import LogsQueryClient
    from datetime import timedelta
    import pandas as pd
    
    tenant_id = "<TENANT-ID>"
    client_id = "<CLIENT-ID>"
    client_secret = "<CLIENT-SECRET>"
    
    credential = ClientSecretCredential(
        tenant_id=tenant_id,
        client_id=client_id,
        client_secret=client_secret
    )
    
    client = LogsQueryClient(credential)
    
    kql_query = """
    SigninLogs
    | where TimeGenerated >= ago(7d)
    | where AppDisplayName == "Windows Sign In"
    """

     

  • Hi Zicozen

     

    Are you running the notebook manually, or is it being run as the service principal throughb a pipeline? 

     

    If you're running the notebook manually, notebookutils will be using your account as the security context, so you will need to make sure that your account has access to the log analytics workspace.