Forum Discussion
Connecting to Azure Log Analytics for my Fabric Notebook
I am trying to read the data from Azure Log Analytics from a Fabric Notebook
The fabric workspace identity is created and service principal that gets created in Entra Id has been given Log Reader access to Log Analytics. However, when I run the code
Below is my notebook code...
from azure.core.credentials import AccessToken
from azure.monitor.query import LogsQueryClient
from notebookutils import credentials # Native Fabric utility
from datetime import timedelta
import pandas as pd
class FabricCredentialAdapter:
def get_token(self, *scopes, **kwargs):
# Scope for Log Analytics/Azure Monitor
scope = "https://monitor.azure.com/.default"
# Fetch the token using Fabric's internal identity bridge
token_str = credentials.getToken(scope)
# Return as the AccessToken object the SDK expects
return AccessToken(token_str, 3600)
# Initialize the client with the custom adapter
client = LogsQueryClient(credential=FabricCredentialAdapter())
kql_query = """
SigninLogs
| where TimeGenerated >= ago(7d)
| where AppDisplayName == "Windows Sign In"
| where isnotempty(IPAddress) and IPAddress startswith "185.192.159."
| project
TimeGenerated,
UserPrincipalName,
AppDisplayName,
IPAddress,
Location = tostring(LocationDetails.city),
Country = tostring(LocationDetails.countryOrRegion),
Device = tostring(DeviceDetail.displayName),
OS = tostring(DeviceDetail.operatingSystem),
Browser = tostring(DeviceDetail.browser),
StatusCode = tostring(Status.errorCode),
StatusReason = tostring(Status.failureReason),
ConditionalAccessStatus
"""
response = client.query_workspace(
workspace_id="5a66b300-5e65-43ff-87e0-118337a7bf8f",
# query="AzureActivity | take 10",
query=kql_query,
timespan=timedelta(days=7)
)
if response.tables:
import pandas as pd
df = pd.DataFrame(response.tables[0].rows, columns=response.tables[0].columns)
display(df)
And I am getting the following error...
Py4JJavaError: An error occurred while calling z:mssparkutils.credentials.getToken. : java.io.IOException: 500 {"code":"INTERNAL_ERROR","subCode":0,"message":"An internal error occurred.","timeStamp":"2026-01-26T11:33:45.5084799Z","httpStatusCode":500,"hresult":-2147467259,"details":[{"code":"RootActivityId","message":"c21253f2-0364-446d-8ce6-51298e132c19"},{"code":"Category","message":"System"},{"code":"Source","message":"TM"}]} [BEGIN_IMPULSE_EXCEPTION] [ImpulseErrorCode:Spark_System_TM_INTERNAL_ERROR] [TSGCode:] [Retriable:true] [END_IMPULSE_EXCEPTION] at com.microsoft.azure.trident.tokenlibrary.TokenLibrary.getAccessToken(TokenLibrary.scala:530) at com.microsoft.azure.trident.tokenlibrary.TokenLibrary.getAccessToken(TokenLibrary.scala:448) at com.microsoft.azure.trident.tokenlibrary.TokenLibrary$.getAccessToken(TokenLibrary.scala:1311) at mssparkutils.credentials$.getToken(credentials.scala:41) at mssparkutils.credentials.getToken(credentials.scala) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at py4j.reflection.MethodInvoker.invoke(MethodInvoker.java:244) at py4j.reflection.ReflectionEngine.invoke(ReflectionEngine.java:374) at py4j.Gateway.invoke(Gateway.java:282) at py4j.commands.AbstractCommand.invokeMethod(AbstractCommand.java:132) at py4j.commands.CallCommand.execute(CallCommand.java:79) at py4j.GatewayConnection.run(GatewayConnection.java:238) at java.base/java.lang.Thread.run(Thread.java:829)
Any ideas..? Is it possible to read the data in the Azure Log Analytics from a Fabric Notebook...?
Thanks for your help in advance
Tobi
Hi Zicozen
You can't use Workspace Identity to authenticate to Azure Log Analytics - already covered in another thread.
Fabric workspace identities cannot currently acquire tokens for the Azure Monitor (Log Analytics) resource provider.Solved: Re: Unable to Use Managed Identity Authentication ... - Microsoft Fabric Community
You can however use a service principal (Azure AD App Registration) and use the code below -
from azure.identity import ClientSecretCredential from azure.monitor.query import LogsQueryClient from datetime import timedelta import pandas as pd tenant_id = "<TENANT-ID>" client_id = "<CLIENT-ID>" client_secret = "<CLIENT-SECRET>" credential = ClientSecretCredential( tenant_id=tenant_id, client_id=client_id, client_secret=client_secret ) client = LogsQueryClient(credential) kql_query = """ SigninLogs | where TimeGenerated >= ago(7d) | where AppDisplayName == "Windows Sign In" """
2 Replies
- deborshi_nagSuper User
Hi Zicozen
You can't use Workspace Identity to authenticate to Azure Log Analytics - already covered in another thread.
Fabric workspace identities cannot currently acquire tokens for the Azure Monitor (Log Analytics) resource provider.Solved: Re: Unable to Use Managed Identity Authentication ... - Microsoft Fabric Community
You can however use a service principal (Azure AD App Registration) and use the code below -
from azure.identity import ClientSecretCredential from azure.monitor.query import LogsQueryClient from datetime import timedelta import pandas as pd tenant_id = "<TENANT-ID>" client_id = "<CLIENT-ID>" client_secret = "<CLIENT-SECRET>" credential = ClientSecretCredential( tenant_id=tenant_id, client_id=client_id, client_secret=client_secret ) client = LogsQueryClient(credential) kql_query = """ SigninLogs | where TimeGenerated >= ago(7d) | where AppDisplayName == "Windows Sign In" """ - tayloramySuper User
Hi Zicozen,
Are you running the notebook manually, or is it being run as the service principal throughb a pipeline?
If you're running the notebook manually, notebookutils will be using your account as the security context, so you will need to make sure that your account has access to the log analytics workspace.