Modify callout policy of KQL database

[jan_l]

Hi everyone,
I tried to reproduce the following example in a KQL queryset: series_fbprophet_forecast_fl() - Azure Data Explorer & Real-Time Analytics | Microsoft Learn

However, when calling the UDF, I obtain the following error message:

Cannot invoke callout of type 'sandbox_artifacts' to 'https://artifactswestus.blob.core.windows.net/public/prophet-1.1.5.zip' due to callout policy.

When I try to modify the callout policy as desbribed here 

.alter cluster policy callout command - Azure Data Explorer & Real-Time Analytics | Microsoft Learn, I receive the following error message:

"Principal 'aaduser=***' is not authorized to perform operation 'ClusterCalloutPolicyAlterCommand' on 'https://****.kusto.fabric.microsoft.com:443/'."

What permissions in Fabric do I need to change the callout policy of the KQL Database? I only found help for Data Explorer Clusters, but not for Fabric KQL databases. I am admin of the workspace containing the database.

The same problem occurs, when I want to install additional Python libraries on the cluster.

Thanks in advance!

[v-yifanw-msft]

Hi @jan_l ,

Based on the error message you encountered, it appears that you do not have the necessary permissions to change the cluster labelling policy. You can follow the steps below to troubleshoot the problem:

1. Ensure that your user account has the Structure Administrator role, which grants you the permissions required to change the cluster policy. 

2. Use the command correctly when modifying the labelling policy.

 .alter cluster policy callout ​

3. For more detailed information about the permissions required to change security policies, see the following documentation:
Row-level security in Fabric data warehousing - Microsoft Fabric | Microsoft Learn

Best Regards,

Ada Wang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[jan_l]

Hi @v-yifanw-msft,
thank you for your reply!
Sorry that I have to ask again, but I was not able to find any information about the Structure Administrator Role, or which role ist necessary, to modify KQL Cluster policies. Could you pleaso provide me a link, or some information, where this role can be assigned?

Best regards,
Jan