Forum Discussion
Microsoft EmployeeFetching data from Fabric EventHouse's KQL DB using C#
Hi Anonymous ,
You're correctly:
- Using a User Assigned Managed Identity (UAMI).
- Acquiring a token with the proper Kusto (ADX) scope
- Providing the UAMI with:
- Contributor access on the Fabric workspace.
- All available permissions on the Eventhouse / KQL DB.
Yet you still get:
<Client ID> is not authorized to read database
That’s because Fabric’s implementation of KQL (Eventhouse) is not the same as regular Azure Data Explorer (ADX). It is currently missing support for certain Kusto management commands, role-based access control via Kusto commands, and cluster-level permission management.
How to fix / move forward
Temporary Workaround (Production Suggestion)
For now, consider using a service principal (client ID + secret or cert) instead of a managed identity. Here's how:
- Register an Azure AD App in your tenant (if not already done).
- Assign the app the "Contributor" role at the Fabric workspace level.
- Use client credentials flow to authenticate and obtain a token for Kusto.
- Use the token with REST API or SDK to query the Eventhouse.
If that also results in the same “not authorized” error — then the only viable workaround is:
Access via a user identity with delegated permissions (not ideal for automation).
Alternative: Hybrid Access via Power BI/Fabric Pipelines
You can consider building a Fabric Data Factory pipeline that runs queries against KQL DB (Eventhouse), where access is mediated by Fabric workspace-level permissions (which do work), rather than calling the REST API directly.
That’s not always production-grade for app-level access, but it's a viable workaround while Microsoft continues expanding Fabric capabilities
Add an Eventhouse destination to an eventstream - Microsoft Fabric | Microsoft Learn
If this post helped resolve your issue, please consider giving it Kudos and marking it as the Accepted Solution. This not only acknowledges the support provided but also helps other community members find relevant solutions more easily.
We appreciate your engagement and thank you for being an active part of the community.
Best regards,
LakshmiNarayana.
Super UserHi @RishikeshPashte ,
Welcome to this Fabric community forum.
Using C# is for Eventhouse the same as for Azure Data Explorer.
See this blog post for working with C# against the database with KQL.
Regarding the Onelake availability question, please create a second question in this forum so those having the same questions can find it (because it's not part of this 'unrelated' thread). Please provide detailed information about the steps you have taken, what works and where the error pops up. did you see that note about the 'Azure Data Explorer database' thus Eventhouse?
Hi svelde
Appreciate the response, I work with Rishikesh and went through the blog post you shared.
The steps mentioned there seem to be related to the Azure Data Explorer, and not the native Fabric Eventhouse/KQL we are using. Just an example, the below query asked to be ran can only be run in ADX and not Eventhouse/KQL DB:
.add database sdktestdata viewers ('aadapp=[application-id];[tenant-guid]')
Please correct me if my understanding is wrong. Thanks.
- svelde
Hello FawadAhmedMAQ
Fabric Eventhouse is Azure Data Explorer under the covers, so the Eventhouse also exposes a simular Query URI endpoint so technically, the same API calls can be made.
You are right about the user credentials, the way to give the SDK access to Eventhouse tables or databases is not on par with Azure Data Explorer. I cannot find a reference for providing access to the KQL database tables to (managed) identities.
Still, it could be possible to use the 'current user' if we can impersonate that account.
I remember I was able to have Managed Grafana connected to the Eventhouse the same way.
I see v-lgarikapat posted an alternative flow where an EntraID application registration is used.