diff --git a/data-explorer/external-tables-managed-identities.md b/data-explorer/external-tables-managed-identities.md index d7a7825172..09a7874b78 100644 --- a/data-explorer/external-tables-managed-identities.md +++ b/data-explorer/external-tables-managed-identities.md @@ -3,7 +3,7 @@ title: How to authenticate using managed identities with external tables in Azur description: Learn how to use managed identities with external tables in Azure Data Explorer cluster. ms.reviewer: itsagui ms.topic: how-to -ms.date: 04/20/2023 +ms.date: 07/13/2026 ms.custom: sfi-ropc-nochange --- @@ -80,7 +80,6 @@ The following table shows the required permissions by external resource. To impo |--|--|--|--| |Azure Blob Storage | Storage Blob Data Reader | Storage Blob Data Contributor |[Assign an Azure role](/azure/storage/blobs/assign-azure-role-data-access?tabs=portal)| |Data Lake Storage Gen2| Storage Blob Data Reader | Storage Blob Data Contributor |[Assign an Azure role](/azure/storage/blobs/assign-azure-role-data-access?tabs=portal)| -|Data Lake Storage Gen1| Reader | Contributor |[Assign an Azure role](/azure/data-lake-store/data-lake-store-secure-data?branch=main#assign-users-or-security-groups-to-data-lake-storage-gen1-accounts) ### [SQL Server](#tab/sql-server) diff --git a/data-explorer/kusto/api/connection-strings/storage-connection-strings.md b/data-explorer/kusto/api/connection-strings/storage-connection-strings.md index 7f757b8913..eee76364b1 100644 --- a/data-explorer/kusto/api/connection-strings/storage-connection-strings.md +++ b/data-explorer/kusto/api/connection-strings/storage-connection-strings.md @@ -3,7 +3,7 @@ title: Storage connection strings description: This article describes storage connection strings. ms.reviewer: shanisolomon, natinimn ms.topic: reference -ms.date: 07/01/2026 +ms.date: 07/13/2026 --- # Storage connection strings @@ -43,6 +43,9 @@ Each storage type has a different connection string format. See the following ta For OneLake, *Workspace* is the Microsoft Fabric workspace name or GUID, and *Item* is the item name with its type suffix (for example, `MyLakehouse.Lakehouse`) or the item GUID. When you use GUIDs, specify them for both the workspace and the item and omit the type suffix, for example `https://onelake.dfs.fabric.microsoft.com///Files/data`. +> [!IMPORTANT] +> The Azure Data Lake Storage Gen1 (`adl://`) scheme isn't supported by the [externaldata operator](../../query/externaldata-operator.md) or by `.create`/`.alter`/`.create-or-alter` of [Azure Storage external tables](../../management/external-tables-azure-storage.md) (including [delta external tables](../../management/external-tables-delta-lake.md)). For those scenarios, use Azure Blob Storage or Azure Data Lake Storage Gen2 connection strings. + > [!NOTE] > To prevent secrets from showing up in traces, use [obfuscated string literals](../../query/scalar-data-types/string.md#obfuscated-string-literals). diff --git a/data-explorer/kusto/management/external-tables-azure-storage.md b/data-explorer/kusto/management/external-tables-azure-storage.md index 6d242693ca..8ca576b24c 100644 --- a/data-explorer/kusto/management/external-tables-azure-storage.md +++ b/data-explorer/kusto/management/external-tables-azure-storage.md @@ -3,14 +3,14 @@ title: Create and alter Azure Storage external tables description: This article describes how to create and alter external tables based on Azure Blob Storage or Azure Data Lake ms.reviewer: orspodek, natinimn ms.topic: reference -ms.date: 07/01/2026 +ms.date: 07/13/2026 --- # Create and alter Azure Storage external tables > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] -The commands in this article can be used to create or alter an Azure Storage [external table](../query/schema-entities/external-tables.md) in the database from which the command is executed. An Azure Storage external table references data located in Azure Blob Storage, Azure Data Lake Store Gen1, Azure Data Lake Store Gen2, or OneLake (Microsoft Fabric). +The commands in this article can be used to create or alter an Azure Storage [external table](../query/schema-entities/external-tables.md) in the database from which the command is executed. An Azure Storage external table references data located in Azure Blob Storage, Azure Data Lake Storage Gen2, or OneLake (Microsoft Fabric). > [!NOTE] > If the table exists, the `.create` command fails with an error. Use `.create-or-alter` or `.alter` to modify existing tables. @@ -41,7 +41,7 @@ To `.create-or-alter` an external table using managed identity authentication re |*Partitions*| `string` || A comma-separated list of columns by which the external table is partitioned. Partition column can exist in the data file itself, or as part of the file path. See [partitions formatting](#partitions-formatting) to learn how this value should look.| |*PathFormat*| `string` ||An external data folder URI path format to use with partitions. See [path format](#path-format).| |*DataFormat*| `string` | :heavy_check_mark:|The data format, which can be any of the [ingestion formats](../ingestion-supported-formats.md). We recommend using the `Parquet` format for external tables to improve query and export performance, unless you use `JSON` paths mapping. When using an external table for [export scenario](data-export/export-data-to-an-external-table.md), you're limited to the following formats: `CSV`, `TSV`, `JSON`, and `Parquet`.| -|*StorageConnectionString*| `string` | :heavy_check_mark:|One or more comma-separated paths to Azure Blob Storage blob containers, Azure Data Lake Gen 2 file systems, Azure Data Lake Gen 1 containers, or OneLake (Microsoft Fabric) paths, including credentials. The provided connection string determines the external table storage type. See [storage connection strings](../api/connection-strings/storage-connection-strings.md).| +|*StorageConnectionString*| `string` | :heavy_check_mark:|One or more comma-separated paths to Azure Blob Storage blob containers, Azure Data Lake Storage Gen2 file systems, or OneLake (Microsoft Fabric) paths, including credentials. The provided connection string determines the external table storage type. See [storage connection strings](../api/connection-strings/storage-connection-strings.md).| |*Property*| `string` ||A key-value property pair in the format *PropertyName* `=` *PropertyValue*. See [optional properties](#optional-properties).| > [!NOTE] @@ -58,23 +58,23 @@ The following table lists the supported authentication methods for Azure Storage ::: moniker range="azure-data-explorer" -| Authentication method | Azure Blob Storage / Data Lake Storage Gen2 | Data Lake Storage Gen1 | -|--|--|--| -|[Impersonation](../api/connection-strings/storage-connection-strings.md#impersonation)|**Read permissions:** Storage Blob Data Reader
**Write permissions:** Storage Blob Data Contributor|**Read permissions:** Reader
**Write permissions:** Contributor| -|[Managed identity](../api/connection-strings/storage-connection-strings.md#managed-identity)|**Read permissions:** Storage Blob Data Reader
**Write permissions:** Storage Blob Data Contributor|**Read permissions:** Reader
**Write permissions:** Contributor| -|[Shared Access (SAS) token](../api/connection-strings/storage-connection-strings.md#shared-access-sas-token)|**Read permissions:** List + Read
**Write permissions:** Write|This authentication method isn't supported in Gen1.| -|[Microsoft Entra access token](../api/connection-strings/storage-connection-strings.md#microsoft-entra-access-token)|No additional permissions required.|No additional permissions required.| -|[Storage account access key](../api/connection-strings/storage-connection-strings.md#storage-account-access-key)|No additional permissions required.|This authentication method isn't supported in Gen1.| +| Authentication method | Azure Blob Storage / Data Lake Storage Gen2 | +|--|--| +|[Impersonation](../api/connection-strings/storage-connection-strings.md#impersonation)|**Read permissions:** Storage Blob Data Reader
**Write permissions:** Storage Blob Data Contributor| +|[Managed identity](../api/connection-strings/storage-connection-strings.md#managed-identity)|**Read permissions:** Storage Blob Data Reader
**Write permissions:** Storage Blob Data Contributor| +|[Shared Access (SAS) token](../api/connection-strings/storage-connection-strings.md#shared-access-sas-token)|**Read permissions:** List + Read
**Write permissions:** Write| +|[Microsoft Entra access token](../api/connection-strings/storage-connection-strings.md#microsoft-entra-access-token)|No additional permissions required.| +|[Storage account access key](../api/connection-strings/storage-connection-strings.md#storage-account-access-key)|No additional permissions required.| ::: moniker-end ::: moniker range="microsoft-fabric" -| Authentication method | Azure Blob Storage / Data Lake Storage Gen2 | Data Lake Storage Gen1 | -|--|--|--| -|[Impersonation](../api/connection-strings/storage-connection-strings.md#impersonation)|**Read permissions:** Storage Blob Data Reader
**Write permissions:** Storage Blob Data Contributor|**Read permissions:** Reader
**Write permissions:** Contributor| -|[Shared Access (SAS) token](../api/connection-strings/storage-connection-strings.md#shared-access-sas-token)|**Read permissions:** List + Read
**Write permissions:** Write|This authentication method isn't supported in Gen1.| -|[Microsoft Entra access token](../api/connection-strings/storage-connection-strings.md#microsoft-entra-access-token)|No additional permissions required.|No additional permissions required.| -|[Storage account access key](../api/connection-strings/storage-connection-strings.md#storage-account-access-key)|No additional permissions required.|This authentication method isn't supported in Gen1.| +| Authentication method | Azure Blob Storage / Data Lake Storage Gen2 | +|--|--| +|[Impersonation](../api/connection-strings/storage-connection-strings.md#impersonation)|**Read permissions:** Storage Blob Data Reader
**Write permissions:** Storage Blob Data Contributor| +|[Shared Access (SAS) token](../api/connection-strings/storage-connection-strings.md#shared-access-sas-token)|**Read permissions:** List + Read
**Write permissions:** Write| +|[Microsoft Entra access token](../api/connection-strings/storage-connection-strings.md#microsoft-entra-access-token)|No additional permissions required.| +|[Storage account access key](../api/connection-strings/storage-connection-strings.md#storage-account-access-key)|No additional permissions required.| ::: moniker-end diff --git a/data-explorer/kusto/management/external-tables-delta-lake.md b/data-explorer/kusto/management/external-tables-delta-lake.md index 55570016ed..1c778b2887 100644 --- a/data-explorer/kusto/management/external-tables-delta-lake.md +++ b/data-explorer/kusto/management/external-tables-delta-lake.md @@ -3,14 +3,14 @@ title: Create and alter Azure Storage delta external tables description: This article describes how to create and alter delta external tables ms.reviewer: igborodi ms.topic: reference -ms.date: 08/11/2024 +ms.date: 07/13/2026 ms.custom: sfi-ropc-nochange --- # Create and alter delta external tables on Azure Storage > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] -The commands in this article can be used to create or alter a delta [external table](../query/schema-entities/external-tables.md) in the database from which the command is executed. A delta external table references Delta Lake table data located in Azure Blob Storage, Azure Data Lake Store Gen1, or Azure Data Lake Store Gen2. +The commands in this article can be used to create or alter a delta [external table](../query/schema-entities/external-tables.md) in the database from which the command is executed. A delta external table references Delta Lake table data located in Azure Blob Storage or Azure Data Lake Storage Gen2. > [!NOTE] > If the table exists, the `.create` command will fail with an error. Use `.create-or-alter` or `.alter` to modify existing tables. @@ -35,7 +35,7 @@ To `.create-or-alter` an external table using managed identity authentication re |--|--|--|--| |*TableName*| `string` | :heavy_check_mark:|An external table name that adheres to the [entity names](../query/schema-entities/entity-names.md) rules. An external table can't have the same name as a regular table in the same database.| |*Schema*| `string` ||The optional external data schema is a comma-separated list of one or more column names and [data types](../query/scalar-data-types/index.md), where each item follows the format: *ColumnName* `:` *ColumnType*. If not specified, it will be automatically inferred from the delta log based on the latest delta table version.| -|*StorageConnectionString*| `string` | :heavy_check_mark:|delta table root folder path, including credentials. Can point to Azure Blob Storage blob container, Azure Data Lake Gen 2 file system or Azure Data Lake Gen 1 container. The external table storage type is determined by the provided connection string. See [storage connection strings](../api/connection-strings/storage-connection-strings.md).| +|*StorageConnectionString*| `string` | :heavy_check_mark:|delta table root folder path, including credentials. Can point to an Azure Blob Storage blob container or an Azure Data Lake Storage Gen2 file system. The external table storage type is determined by the provided connection string. See [storage connection strings](../api/connection-strings/storage-connection-strings.md).| |*Property*| `string` ||A key-value property pair in the format *PropertyName* `=` *PropertyValue*. See [optional properties](#optional-properties).| > [!NOTE] diff --git a/data-explorer/kusto/query/externaldata-operator.md b/data-explorer/kusto/query/externaldata-operator.md index e50d0ea1b4..004083700e 100644 --- a/data-explorer/kusto/query/externaldata-operator.md +++ b/data-explorer/kusto/query/externaldata-operator.md @@ -3,14 +3,14 @@ title: externaldata operator description: Learn how to use the externaldata operator to return a data table of the given schema whose data was parsed from the specified storage artifact. ms.reviewer: alexans ms.topic: reference -ms.date: 01/27/2025 +ms.date: 07/13/2026 ms.custom: sfi-ropc-nochange --- # externaldata operator > [!INCLUDE [applies](../includes/applies-to-version/applies.md)] [!INCLUDE [fabric](../includes/applies-to-version/fabric.md)] [!INCLUDE [azure-data-explorer](../includes/applies-to-version/azure-data-explorer.md)] [!INCLUDE [monitor](../includes/applies-to-version/monitor.md)] [!INCLUDE [sentinel](../includes/applies-to-version/sentinel.md)] -The `externaldata` operator returns a table whose schema is defined in the query itself, and whose data is read from an external storage artifact, such as a blob in Azure Blob Storage or a file in Azure Data Lake Storage. +The `externaldata` operator returns a table whose schema is defined in the query itself, and whose data is read from an external storage artifact, such as a blob in Azure Blob Storage or a file in Azure Data Lake Storage Gen2. ::: moniker range="azure-data-explorer" > [!NOTE]