Authentication to another Tenant using a service principal

[jllangley]

Hey Everyone,

I have been enjoying learning Jupyter Notebooks and msticpy.
I have run into an issue I hope someone can give me some advice.
I am using Azure ML Notebooks in a tenant and want to do a log analytics query in another separated tenant. I have the second workspace configured in my msticpyconfig.yaml file, with the correct tenant id, and workspace id. When I run my qry_prov.connect I am getting an "InvalidTokenError" and shows the Oath token is from the wrong issuer and that I need one from my second tenant. That makes sense to me, but I do not understand how to make it use a service principal to connect to my second tenant. Base on the documents I read about the order in which mysticpy authenticates it may not be possible? Here is what I have done so far.

I have added AzureCli in the mysticpyconfig file. I added auth_methods: cli, then under that a clientId ={redacted}, and clientSecret = {redacted}

I would appreciate any help!
Jack

`# Imports
from msticpy.nbtools.utility import check_py_version

MIN_REQ_PYTHON = (3, 6)
check_py_version(MIN_REQ_PYTHON)

from typing import List, Dict, Union

setting pandas display options for dataframe

import pandas as pd
pd.set_option("display.max_rows", 100)
pd.set_option("display.max_columns", 50)
pd.set_option("display.max_colwidth", 100)

msticpy imports

from msticpy.analysis.anomalous_sequence import sessionize
from msticpy.analysis.anomalous_sequence.utils.data_structures import Cmd
from msticpy.analysis.anomalous_sequence import anomalous
from msticpy.analysis.anomalous_sequence.model import Model
from msticpy.data import QueryProvider
from msticpy.nbtools.wsconfig import WorkspaceConfig

%env KQLMAGIC_LOAD_MODE=silent

ws_config = WorkspaceConfig(workspace="SecondTenant")

query = """
AzureActivity | limit 10
"""
qry_prov = QueryProvider("LogAnalytics")
qry_prov.connect(connection_str=ws_config.code_connect_str)

[petebryan]

Hey @jllangley sorry for the slow response on this, we've been really tied up with other things but this is on my list to investigate this week.

[jllangley]

No worries @petebryan.
I have figured it out.
I read through the kql_drivery.py code and see there is an option for mp_az_auth. So here is what I ended up doing that worked.

qry_prov.connect(WorkspaceConfig(), mp_az_auth="env")

I see some mentions of this option in a few release update notes which really helped me better understand its usage. I'll link it here for any others looking to do the same. https://newreleases.io/project/github/microsoft/msticpy/release/v1.5.1

[petebryan]

Great, yes so some authentication methods will default to the home tenant of the user. You can force the auth methods to auth to a different tenant by setting mp_az_tenant_id to the tenant ID you want to auth to. Your solution that force it to use an auth method only linked to the workspaces tenant also works.

[petebryan]

This is the PR that implemented this if you want a better idea of whats involved - #277