diff --git a/data-explorer/includes/managed-identity.md b/data-explorer/includes/managed-identity.md index ea09f71418..819d08403e 100644 --- a/data-explorer/includes/managed-identity.md +++ b/data-explorer/includes/managed-identity.md @@ -37,10 +37,10 @@ ms.date: 01/09/2025 "id": "/subscriptions/00001111-aaaa-2222-bbbb-3333cccc4444/resourceGroups/my-resource-group/providers/Microsoft.ManagedIdentity/userAssignedIdentities/my-managed-identity", "location": "eastus", "name": "my-managed-identity", - "principalId": "00001111-aaaa-2222-bbbb-3333cccc4444", + "principalId": "ffffffff-eeee-dddd-cccc-bbbbbbbbbbb0", "resourceGroup": "my-resource-group", "tags": {}, - "tenantId": "00001111-aaaa-2222-bbbb-3333cccc4444", + "tenantId": "aaaabbbb-0000-cccc-1111-dddd2222eeee", "type": "Microsoft.ManagedIdentity/userAssignedIdentities" } ``` diff --git a/data-explorer/kusto/api/monaco/host-web-ux-in-iframe.md b/data-explorer/kusto/api/monaco/host-web-ux-in-iframe.md index 094ea5df93..f5f1f56024 100644 --- a/data-explorer/kusto/api/monaco/host-web-ux-in-iframe.md +++ b/data-explorer/kusto/api/monaco/host-web-ux-in-iframe.md @@ -33,7 +33,7 @@ The `workspace=` query parameter creates a separate workspace for the embe ### Handle authentication -When embedding the web UI, the hosting page is responsible for authentication. The following diagrams describe the authentication flow. +When you embed the web UI, the hosting page is responsible for authentication. The following diagrams describe the authentication flow. :::image type="content" source="../media/host-web-ux-in-iframe/adx-embed-sequence-diagram.png" lightbox="../media/host-web-ux-in-iframe/adx-embed-sequence-diagram.png" alt-text="Diagram that shows the authentication flow for an embedded web U I iframe."::: @@ -60,7 +60,7 @@ Use the following steps to handle authentication: | Graph | `People.Read` | `People.Read`, `User.ReadBasic.All`, `Group.Read.All` | | Dashboards | `https://rtd-metadata.azurewebsites.net/user_impersonation` | `https://rtd-metadata.azurewebsites.net/user_impersonation` | - For example, the following function maps scopes based on the information in the table. + For example, the following function maps the scopes based on the information in the table. ```javascript function mapScope(scope) { @@ -74,7 +74,7 @@ Use the following steps to handle authentication: 1. Get a [JWT access token](https://tools.ietf.org/html/rfc7519) from the [Perform Single Page Application (SPA) authentication](../rest/authenticate-with-msal.md#perform-single-page-application-spa-authentication) for the scope. This code replaces placeholder CODE-1. - For example, you can use @azure/MSAL-react to get the access token. The example uses the **mapScope** function you defined earlier. + For example, you can use `@azure/MSAL-react` to get the access token. The example uses the **mapScope** function you defined earlier. ```javascript import { useMsal } from "@azure/msal-react"; @@ -91,7 +91,7 @@ Use the following steps to handle authentication: ``` > [!IMPORTANT] - > You can only use User Principal Name (UPN) for authentication, service principals are not supported. + > You can only use User Principal Name (UPN) for authentication, service principals aren't supported. 1. Post a **postToken** message with the access token. This code replaces placeholder CODE-2: @@ -122,9 +122,15 @@ To embed a dashboard, a trust relationship must be established between the host' 1. Select **requiredResourceAccess**. 1. In the manifest, add the following entry: + > [!IMPORTANT] + > Replace `` with the application ID of the **RTD Metadata Service**. To get the application ID of this service, follow these steps: + > - Sign in to the Azure portal. + > - In the search bar, enter **RTD Metadata Service**, and then select the **Service Principal**: **RTD Metadata Service**. + > - On the **Enterprise Application** page for **RTD Metadata Service**, note down the value of the **Application ID**. + ```json { - "resourceAppId": "35e917a9-4d95-4062-9d97-5781291353b9", + "resourceAppId": "", "resourceAccess": [ { "id": "388e2b3a-fdb8-4f0b-ae3e-0692ca9efc1c", @@ -134,16 +140,18 @@ To embed a dashboard, a trust relationship must be established between the host' } ``` - - `35e917a9-4d95-4062-9d97-5781291353b9` is the application ID of Azure Data Explorer dashboard service. - - `388e2b3a-fdb8-4f0b-ae3e-0692ca9efc1c` is the user_impersonation permission. + In the above code, `388e2b3a-fdb8-4f0b-ae3e-0692ca9efc1c` is the user_impersonation permission. 1. In the **Manifest**, save your changes. 1. Select **API permissions** and validate you have a new entry: **RTD Metadata Service**. 1. Under Microsoft Graph, add permissions for `People.Read`, `User.ReadBasic.All`, and `Group.Read.All`. 1. In Azure PowerShell, add the following new service principal for the app: + > [!IMPORTANT] + > Replace `` with the application ID of the **RTD Metadata Service** you got earlier. + ```powershell - New-MgServicePrincipal -AppId 35e917a9-4d95-4062-9d97-5781291353b9 + New-MgServicePrincipal -AppId ``` @@ -158,7 +166,7 @@ To embed a dashboard, a trust relationship must be established between the host' >