title: AAD Authentication with Azure Data Explorer (Kusto) not working for simple query via API
body: <p>I'm attempting to access Kusto via the API with Python (a "headless" script, in other words), and would like to use an AAD application for authentication. I'm specifically working with the sample code on <a href="https://github.com/Azure/azure-kusto-python/blob/master/azure-kusto-data/tests/sample.py" rel="nofollow noreferrer">https://github.com/Azure/azure-kusto-python/blob/master/azure-kusto-data/tests/sample.py</a>, which attempts to query the Samples > StormEvents table on the cluster <a href="https://help.kusto.windows.net" rel="nofollow noreferrer">https://help.kusto.windows.net</a>. I can run the query in the Kusto explorer just fine, but I'm getting "Caller is not authorized to perform this action" when trying to run the sample code.</p>
  
  <p>I followed the instructions on <a href="https://kusto.azurewebsites.net/docs/management/access-control/aad.html" rel="nofollow noreferrer">https://kusto.azurewebsites.net/docs/management/access-control/aad.html</a> and <a href="https://kusto.azurewebsites.net/docs/management/access-control/how-to-provision-aad-app.html" rel="nofollow noreferrer">https://kusto.azurewebsites.net/docs/management/access-control/how-to-provision-aad-app.html</a> to create an AAD application on the Azure portal and add API permissions for Azure Data Explorer. In the code, I have the "Application (client) ID" from the portal in the client_id field, and the appropriate secret in the client_secret field. The authority_id field is set to 72f988bf-86f1-41af-91ab-2d7cd011db47, which is what's shown on the portal as well as the table on <a href="https://kusto.azurewebsites.net/docs/management/access-control/aad.html#authenticating-with-aad-programmatically" rel="nofollow noreferrer">https://kusto.azurewebsites.net/docs/management/access-control/aad.html#authenticating-with-aad-programmatically</a> The app name (and client ID) is accepted on <a href="https://www.analytics.msftcloudes.com/support/directory" rel="nofollow noreferrer">https://www.analytics.msftcloudes.com/support/directory</a> just fine.</p>
  
  <p>The code is thus as follows (omitting the imports and the specific secrets):</p>
  
  <pre class="lang-py prettyprint-override"><code>cluster = "https://help.kusto.windows.net"
  
  client_id = "&lt;omitted&gt;"
  client_secret = "&lt;omitted&gt;"
  authority_id = "72f988bf-86f1-41af-91ab-2d7cd011db47"
  
  kcsb = KustoConnectionStringBuilder.with_aad_application_key_authentication(
      cluster, client_id, client_secret, authority_id
  )
  
  client = KustoClient(kcsb)
  db = "Samples"
  query = "StormEvents | take 10"
  response = client.execute(db, query)
  </code></pre>
  
  <p>The failure output is:</p>
  
  <p>azure.kusto.data.exceptions.KustoServiceError: (KustoServiceError(...), [{'error': {'code': 'Forbidden', 'message': 'Caller is not authorized to perform this action', '@type': 'Kusto.DataNode.Exceptions.UnauthorizedDatabaseAccessException', '@message': "Principal 'AAD app id=(omitted)' is not authorized to access database 'Samples'.", '@context': {'timestamp': '2019-06-05T19:39:17.3493255Z', 'serviceAlias': 'HELP', 'machineName': 'KEngine000000', 'processName': 'Kusto.WinSvc.Svc', 'processId': 18832, 'threadId': 25568, 'appDomainName': 'Kusto.WinSvc.Svc.exe', 'clientRequestd': 'KPC.execute;9ede2b2d-5fba-478c-ad8f-8306284cf6e9', 'activityId': 'efdb96c9-da46-4d5f-b739-54661e7002e3', 'subActivityId': '33f89e2b-2347-447a-abe9-81e586d0e2a0', 'activityType': 'DN-FE-ExecuteQuery', 'parentActivityId': '438b2bb3-26fb-4f7e-813d-bc8a5c39ce1c', 'activityStack': '(Activity stack: CRID=KPC.execute;9ede2b2d-5fba-478c-ad8f-8306284cf6e9 ARID=efdb96c9-da46-4d5f-b739-54661e7002e3 > KD-Query-Client-ExecuteQueryAsKustoDataStream/5ddd9239-e742-4edc-ab3e-55d59a1f2c99 > P-WCF-Service-ExecuteQueryInternalAsKustoDataStream--IClientServiceCommunicationContract/438b2bb3-26fb-4f7e-813d-bc8a5c39ce1c > DN-FE-ExecuteQuery/33f89e2b-2347-447a-abe9-81e586d0e2a0)'}, '@permanent': True}}])</p>
  
  <p>I've also added the sample cluster in Kusto Explorer, like the docs say.</p>
  
  <p>Am I still missing something?</p>