Copy Data from Log Analytics into fabric

[Danfountain]

Hi all,

I am really struggling with trying to get data from Log Analytics into Fabric (for consuming with other auditing logs from other sources).

I kind of managed to get it running but the Authentication is causing some issues.  I have a Power BI gateway to connect to sources.  Where as the service account I use to connect to SQL doesnt prompt MFA, the same service account when connecting to the Log Analytics is then triggering MFA which I cannot set up as its a service account.  Therefore I am temporarily using my own account but I think the MFA is timing out after a couple of days.

Whats the easiest way to get data from Log Analytics automatically on a daily basis?  I just cannot seem to work it out.  Happy to use any of the data factory toolset (I am currently a Data Flow Gen 2).

Dan

[v-tsaipranay · Accepted solution]

Hi @Danfountain ,

Thank you for reaching out to the Microsoft fabric community forum. 

The issue occurs because MFA is triggered when a service account connects to Log Analytics, which interrupts your automated daily data ingestion into Fabric. Using a personal account as a workaround isn’t recommended, as token expiration causes ongoing failures.

A more effective solution is to use an Azure App Registration (service principal) with client credentials (client ID and secret or certificate). This approach avoids MFA and is designed for automated, non-interactive scenarios. Assign the service principal the Log Analytics Reader role on the workspace and use the Azure Monitor REST API to query data securely.

In Microsoft Fabric, you can set this up with Dataflow Gen2 using the Web API connector, or create a Data Pipeline with a Copy activity to call the Log Analytics API. This allows your pipeline to run automatically on schedule.

Hope this helps. Please reach out for further assistance.

Thank you.

[Danfountain]

Thank you for that.  Marked as accepted but still have a question.

The same service account that the MFA is popping up for - doesnt have the same issue when connecting to Azure SQL servers.  Why is the MFA only a problem for this and not for SQL on the same account?

[v-tsaipranay]

Hi @Danfountain ,

The difference in MFA behavior is because your organization's Conditional Access policies in Microsoft Entra ID are set up differently for each service. MFA can be required depending on the Azure service, the application, or the authentication method. For instance, your Azure SQL connection may use SQL authentication or a trusted network that skips CA rules, while Log Analytics uses Azure AD authentication and might have a policy that specifically requires MFA for that endpoint.

To verify this, you should work with your Azure AD administrator to review the Conditional Access policies for the service account and see if there is a policy targeting Log Analytics or the Azure portal/API. Adjusting these policies or using an App Registration with client credentials could help bypass MFA for automated, non-interactive connections.

Hope this helps. Please reach out for further assistance.

Thank you.