FinOps hub agent in Microsoft Copilot Studio issue with Kusto Query MCP Server

[DMarshall-1]

Hi All

Looking for some advice, I have configured the Copilot Studio agent by following this guide

https://learn.microsoft.com/en-gb/cloud-computing/finops/toolkit/hubs/configure-ai-copilot-studio

however when I test the query it never works usually with an error similar to

I attempted to initialise the session (detect currency and discover scopes), but the Kusto queries returned syntax errors due to how the environment is structured through the connector.

The query failed because it was executed as a control command incorrectly, causing a syntax error. I will correct the execution and retry as a proper Kusto Query Language command.

It seems the connector is treating standard KQL as an admin command, causing the "dot prefix" error. This indicates that the environment is incorrectly routing query execution. Further progress requires troubleshooting connector configuration to allow query execution in "query" mode rather than "control" mode.

This action needs to be escalated to ensure the KQL queries can run properly.

I have deleted and recreated the agent a couple of times but it always fails to send the commands correctly.

putting the error into Copilot returns

ExecuteControlCommandAsync
/v1/rest/mgmt

The MCP server (or connector behind it) is calling the management endpoint, not the query endpoint.
And from Kusto’s design:

Management endpoint (/mgmt) ⇒ expects commands starting with .
Query endpoint (/query) ⇒ expects normal KQL

a cleaned up version of the error is

{ "ErrorCode": "SYN0100", "ErrorMessage": "Admin commands must have a dot (.) character as their first non-whitespace character", "Query": "Costs_v1_2() | where ChargePeriodStart >= ago(7d) | summarize count() by BillingCurrency | top 1 by count_", "Context": "Executing via management endpoint instead of query endpoint" }

I have tried both Microsoft Entra ID Integrated and Service Principal accounts with the same error in connection

Has anyone gotten it to work or know what is configured wrong so I can test this?

Thanks

[Roland Krummenacher (RolandKrummenacher)]

Thanks — I dug into the connector, and the endpoint explanation doesn't hold up.

The Kusto Query MCP Server exposes a single tool, listKustoResultsPost. It maps to the connector's Run KQL query action at /ListKustoResults/false. That trailing false is the "this is not a control command" flag, so the tool always goes to the query endpoint. It can't reach /v1/rest/mgmt. The tool description saying "Kusto Query Management server" is just the internal action name and is misleading.

Also, the Context: "Executing via management endpoint instead of query endpoint" field in your cleaned-up error isn't part of any real Kusto error payload. I think Copilot invented that explanation when you pasted the error in. So let's work from the raw output instead.

Two things to check first:

1. Is the tool switched on? Open your agent → Tools → Kusto Query MCP Server → Tools section. There's a per-tool toggle next to listKustoResultsPost, separate from the server's Enabled switch. If it's off, the agent has no way to run a query, and the model will often invent a plausible-sounding failure instead of saying so. Our docs don't mention this toggle — we'll fix that.

2. Is the cluster URL complete? The cluster parameter expects a full URL (https://<cluster>.<region>.kusto.windows.net). Our instructions tell you to drop https:// because Copilot Studio strips links from the Instructions field, but they never tell the agent to add it back when it calls the tool. That's a gap on our side. As a test, add this line to the Environment section of your instructions and save:

When calling the Kusto tool, always pass the cluster as https://<YOUR_CLUSTER>.kusto.windows.net

Then start a new test conversation.

If it still fails, could you send the raw failure instead of the summary? Go to Activity (or select the agent's message in the Test panel → activity/trace), open the failing turn, and copy the tool call — the inputs (cluster, db, csl) and the raw response. That tells us exactly what was sent.

[DMarshall-1]

Thanks Roland for looking at this.

For is the tool switched on - yes it is

I have updated the instructions like

putting it anywhere else just gave me a failure to send error

Inputs

DB: Hub
Cluster: https://MYCLUSTER.westeurope.kusto.windows.net
CSL: Costs_v1_2()
| where ChargePeriodStart >= ago(7d)
| summarize count() by BillingCurrency
| top 1 by count_

IsError: true
Content:
[ { "text": "[CIT:78cc6e97-c8af-4271-bfe4-4d82d1aef77d] {\r\n \"ClassName\": \"Kusto.Data.Exceptions.SyntaxException\",\r\n \"Message\": \"clientRequestId: c0db9046-0410-44af-a635-7b8c70313037\",\r\n \"Data\": null,\r\n \"InnerException\": null,\r\n \"HelpURL\": null,\r\n \"StackTraceString\": \" at Kusto.Data.Net.Client.KustoDataHttpClient.<ThrowKustoExceptionFromResponseMessageAsync>d__1.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsyncImpl>d__72.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.<InvokeAsync>d__122.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.d__122.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsync>d__69.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<ExecuteControlCommandAsync>d__41.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.KustoExecutor.KustoExecutor.d__2.MoveNext() in C:\\__w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\KustoExecutor\\KustoExecutor.cs:line 34\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\\r\\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoProviderBase.<ExecuteControlCommandOrQueryAsync>d__2.MoveNext() in C:\\\\__w\\\\1\\\\s\\\\src\\\\Connectors\\\\FirstParty\\\\kusto\\\\Connector\\\\Providers\\\\KustoProviderBase.cs:line 30\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoListResultProvider.d__4.MoveNext() in C:\\_w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\Providers\\KustoListResultProvider.cs:line 49",\r\n "RemoteStackTraceString": null,\r\n "RemoteStackIndex": 0,\r\n "ExceptionMethod": "8\nMoveNext\nKusto.Data, Version=14.1.2.0, Culture=neutral, PublicKeyToken=829a00acde12d551\nKusto.Data.Net.Client.KustoDataHttpClient+d__1\nVoid MoveNext()",\r\n "HResult": -2146233088,\r\n "Source": "Kusto.Data",\r\n "WatsonBuckets": null,\r\n "creationMessage": null,\r\n "creationContext": {\r\n "Timestamp": "2026-09-10T12:28:34.7864566Z",\r\n "ServiceAlias": null,\r\n "MachineName": "aw0ldwk0002KL",\r\n "ProcessName": "w3wp",\r\n "ProcessId": 10948,\r\n "ThreadId": 35672,\r\n "AppDomainName": null,\r\n "CallStack": null,\r\n "ActivityContext": {\r\n "ActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "SubActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "ParentActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "ClientRequestId": "c0db9046-0410-44af-a635-7b8c70313037",\r\n "ActivityType": "KD.RestClient.ExecuteControlCommand"\r\n },\r\n "ActivityStack": "(Activity stack: CRID=c0db9046-0410-44af-a635-7b8c70313037 ARID=0f929b6f-cf0e-42db-8129-c9ff1201198e > KD.RestClient.ExecuteControlCommand/0f929b6f-cf0e-42db-8129-c9ff1201198e)",\r\n "TracingContext": null,\r\n "MonitoredActivityContext": {\r\n "Created": "2026-09-10T12:28:34.7552092Z",\r\n "Activity": {\r\n "ActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "SubActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "ParentActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "ClientRequestId": "c0db9046-0410-44af-a635-7b8c70313037",\r\n "ActivityType": "KD.RestClient.ExecuteControlCommand"\r\n }\r\n },\r\n "ServiceFarm": null,\r\n "TestContext": null\r\n },\r\n "ErrorCode": "SYN0100",\r\n "ErrorReason": "BadRequest",\r\n "ErrorMessage": "Admin commands must have a dot (.) character as their first non-whitespace character",\r\n "DataSource": "https://MYCLUSTER.westeurope.kusto.windows.net/v1/rest/mgmt\",\r\n "DatabaseName": "Hub",\r\n "ClientRequestId": "c0db9046-0410-44af-a635-7b8c70313037",\r\n "ActivityId": "2ad96f73-3fe2-43b2-a54a-4e24745429a6",\r\n "Text": "Costs_v1_2()\n| where ChargePeriodStart >= ago(7d)\n| summarize count() by BillingCurrency\n| top 1 by count",\r\n "ParseErrors": "Admin commands must have a dot (.) character as their first non-whitespace character",\r\n "Line": 0,\r\n "CharacterPositionInLine": 0,\r\n "Token": null\r\n}",
"type": "text"
}
]`

RAW: { "isError": true, "content": [ { "text": "[CIT:78cc6e97-c8af-4271-bfe4-4d82d1aef77d] {\r\n \"ClassName\": \"Kusto.Data.Exceptions.SyntaxException\",\r\n \"Message\": \"clientRequestId: c0db9046-0410-44af-a635-7b8c70313037\",\r\n \"Data\": null,\r\n \"InnerException\": null,\r\n \"HelpURL\": null,\r\n \"StackTraceString\": \" at Kusto.Data.Net.Client.KustoDataHttpClient.<ThrowKustoExceptionFromResponseMessageAsync>d__1.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsyncImpl>d__72.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.<InvokeAsync>d__122.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.d__122.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsync>d__69.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<ExecuteControlCommandAsync>d__41.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.KustoExecutor.KustoExecutor.d__2.MoveNext() in C:\\__w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\KustoExecutor\\KustoExecutor.cs:line 34\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\\r\\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoProviderBase.<ExecuteControlCommandOrQueryAsync>d__2.MoveNext() in C:\\\\__w\\\\1\\\\s\\\\src\\\\Connectors\\\\FirstParty\\\\kusto\\\\Connector\\\\Providers\\\\KustoProviderBase.cs:line 30\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoListResultProvider.d__4.MoveNext() in C:\\_w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\Providers\\KustoListResultProvider.cs:line 49",\r\n "RemoteStackTraceString": null,\r\n "RemoteStackIndex": 0,\r\n "ExceptionMethod": "8\nMoveNext\nKusto.Data, Version=14.1.2.0, Culture=neutral, PublicKeyToken=829a00acde12d551\nKusto.Data.Net.Client.KustoDataHttpClient+d__1\nVoid MoveNext()",\r\n "HResult": -2146233088,\r\n "Source": "Kusto.Data",\r\n "WatsonBuckets": null,\r\n "creationMessage": null,\r\n "creationContext": {\r\n "Timestamp": "2026-09-10T12:28:34.7864566Z",\r\n "ServiceAlias": null,\r\n "MachineName": "aw0ldwk0002KL",\r\n "ProcessName": "w3wp",\r\n "ProcessId": 10948,\r\n "ThreadId": 35672,\r\n "AppDomainName": null,\r\n "CallStack": null,\r\n "ActivityContext": {\r\n "ActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "SubActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "ParentActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "ClientRequestId": "c0db9046-0410-44af-a635-7b8c70313037",\r\n "ActivityType": "KD.RestClient.ExecuteControlCommand"\r\n },\r\n "ActivityStack": "(Activity stack: CRID=c0db9046-0410-44af-a635-7b8c70313037 ARID=0f929b6f-cf0e-42db-8129-c9ff1201198e > KD.RestClient.ExecuteControlCommand/0f929b6f-cf0e-42db-8129-c9ff1201198e)",\r\n "TracingContext": null,\r\n "MonitoredActivityContext": {\r\n "Created": "2026-09-10T12:28:34.7552092Z",\r\n "Activity": {\r\n "ActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "SubActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "ParentActivityId": "0f929b6f-cf0e-42db-8129-c9ff1201198e",\r\n "ClientRequestId": "c0db9046-0410-44af-a635-7b8c70313037",\r\n "ActivityType": "KD.RestClient.ExecuteControlCommand"\r\n }\r\n },\r\n "ServiceFarm": null,\r\n "TestContext": null\r\n },\r\n "ErrorCode": "SYN0100",\r\n "ErrorReason": "BadRequest",\r\n "ErrorMessage": "Admin commands must have a dot (.) character as their first non-whitespace character",\r\n "DataSource": "https://MYCLUSTER.westeurope.kusto.windows.net/v1/rest/mgmt\",\r\n "DatabaseName": "Hub",\r\n "ClientRequestId": "c0db9046-0410-44af-a635-7b8c70313037",\r\n "ActivityId": "2ad96f73-3fe2-43b2-a54a-4e24745429a6",\r\n "Text": "Costs_v1_2()\n| where ChargePeriodStart >= ago(7d)\n| summarize count() by BillingCurrency\n| top 1 by count",\r\n "ParseErrors": "Admin commands must have a dot (.) character as their first non-whitespace character",\r\n "Line": 0,\r\n "CharacterPositionInLine": 0,\r\n "Token": null\r\n}",
"type": "text"
}
]
}`

It then runs a 2nd query

CSL: // Detect most common BillingCurrency in last 7 days
Costs_v1_2()
| where ChargePeriodStart >= ago(7d)
| summarize count() by BillingCurrency
| top 1 by count_

Table:

[ { "text": "[CIT:3d72620f-1534-4175-8d2a-f02d8a033bd6] {\r\n \"ClassName\": \"Kusto.Data.Exceptions.SyntaxException\",\r\n \"Message\": \"clientRequestId: 3bafbd86-e37c-4994-a185-3cdc869903ec\",\r\n \"Data\": null,\r\n \"InnerException\": null,\r\n \"HelpURL\": null,\r\n \"StackTraceString\": \" at Kusto.Data.Net.Client.KustoDataHttpClient.<ThrowKustoExceptionFromResponseMessageAsync>d__1.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsyncImpl>d__72.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.<InvokeAsync>d__122.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.d__122.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsync>d__69.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<ExecuteControlCommandAsync>d__41.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.KustoExecutor.KustoExecutor.d__2.MoveNext() in C:\\__w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\KustoExecutor\\KustoExecutor.cs:line 34\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\\r\\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoProviderBase.<ExecuteControlCommandOrQueryAsync>d__2.MoveNext() in C:\\\\__w\\\\1\\\\s\\\\src\\\\Connectors\\\\FirstParty\\\\kusto\\\\Connector\\\\Providers\\\\KustoProviderBase.cs:line 30\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoListResultProvider.d__4.MoveNext() in C:\\_w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\Providers\\KustoListResultProvider.cs:line 49",\r\n "RemoteStackTraceString": null,\r\n "RemoteStackIndex": 0,\r\n "ExceptionMethod": "8\nMoveNext\nKusto.Data, Version=14.1.2.0, Culture=neutral, PublicKeyToken=829a00acde12d551\nKusto.Data.Net.Client.KustoDataHttpClient+d__1\nVoid MoveNext()",\r\n "HResult": -2146233088,\r\n "Source": "Kusto.Data",\r\n "WatsonBuckets": null,\r\n "creationMessage": null,\r\n "creationContext": {\r\n "Timestamp": "2026-09-10T12:28:41.1969506Z",\r\n "ServiceAlias": null,\r\n "MachineName": "AW0LDWK000241",\r\n "ProcessName": "w3wp",\r\n "ProcessId": 9872,\r\n "ThreadId": 31432,\r\n "AppDomainName": null,\r\n "CallStack": null,\r\n "ActivityContext": {\r\n "ActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "SubActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "ParentActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "ClientRequestId": "3bafbd86-e37c-4994-a185-3cdc869903ec",\r\n "ActivityType": "KD.RestClient.ExecuteControlCommand"\r\n },\r\n "ActivityStack": "(Activity stack: CRID=3bafbd86-e37c-4994-a185-3cdc869903ec ARID=3e3b40b3-b690-4cce-abf9-3f17fe53a451 > KD.RestClient.ExecuteControlCommand/3e3b40b3-b690-4cce-abf9-3f17fe53a451)",\r\n "TracingContext": null,\r\n "MonitoredActivityContext": {\r\n "Created": "2026-09-10T12:28:41.1344471Z",\r\n "Activity": {\r\n "ActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "SubActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "ParentActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "ClientRequestId": "3bafbd86-e37c-4994-a185-3cdc869903ec",\r\n "ActivityType": "KD.RestClient.ExecuteControlCommand"\r\n }\r\n },\r\n "ServiceFarm": null,\r\n "TestContext": null\r\n },\r\n "ErrorCode": "SYN0100",\r\n "ErrorReason": "BadRequest",\r\n "ErrorMessage": "Admin commands must have a dot (.) character as their first non-whitespace character",\r\n "DataSource": "https://MYCLUSTER.westeurope.kusto.windows.net/v1/rest/mgmt\",\r\n "DatabaseName": "Hub",\r\n "ClientRequestId": "3bafbd86-e37c-4994-a185-3cdc869903ec",\r\n "ActivityId": "41e8eec1-f4ed-4abe-9f3e-45c07bdca6c4",\r\n "Text": "// Detect most common BillingCurrency in last 7 days\nCosts_v1_2()\n| where ChargePeriodStart >= ago(7d)\n| summarize count() by BillingCurrency\n| top 1 by count",\r\n "ParseErrors": "Admin commands must have a dot (.) character as their first non-whitespace character",\r\n "Line": 0,\r\n "CharacterPositionInLine": 0,\r\n "Token": null\r\n}",
"type": "text"
}
]`

{ "isError": true, "content": [ { "text": "[CIT:3d72620f-1534-4175-8d2a-f02d8a033bd6] {\r\n \"ClassName\": \"Kusto.Data.Exceptions.SyntaxException\",\r\n \"Message\": \"clientRequestId: 3bafbd86-e37c-4994-a185-3cdc869903ec\",\r\n \"Data\": null,\r\n \"InnerException\": null,\r\n \"HelpURL\": null,\r\n \"StackTraceString\": \" at Kusto.Data.Net.Client.KustoDataHttpClient.<ThrowKustoExceptionFromResponseMessageAsync>d__1.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsyncImpl>d__72.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.<InvokeAsync>d__122.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.d__122.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsync>d__69.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at Kusto.Data.Net.Client.RestClient2.<ExecuteControlCommandAsync>d__41.MoveNext()\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.KustoExecutor.KustoExecutor.d__2.MoveNext() in C:\\__w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\KustoExecutor\\KustoExecutor.cs:line 34\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\\r\\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoProviderBase.<ExecuteControlCommandOrQueryAsync>d__2.MoveNext() in C:\\\\__w\\\\1\\\\s\\\\src\\\\Connectors\\\\FirstParty\\\\kusto\\\\Connector\\\\Providers\\\\KustoProviderBase.cs:line 30\\r\\n--- End of stack trace from previous location where exception was thrown ---\\r\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\r\\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\\r\\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoListResultProvider.d__4.MoveNext() in C:\\_w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\Providers\\KustoListResultProvider.cs:line 49",\r\n "RemoteStackTraceString": null,\r\n "RemoteStackIndex": 0,\r\n "ExceptionMethod": "8\nMoveNext\nKusto.Data, Version=14.1.2.0, Culture=neutral, PublicKeyToken=829a00acde12d551\nKusto.Data.Net.Client.KustoDataHttpClient+d__1\nVoid MoveNext()",\r\n "HResult": -2146233088,\r\n "Source": "Kusto.Data",\r\n "WatsonBuckets": null,\r\n "creationMessage": null,\r\n "creationContext": {\r\n "Timestamp": "2026-09-10T12:28:41.1969506Z",\r\n "ServiceAlias": null,\r\n "MachineName": "AW0LDWK000241",\r\n "ProcessName": "w3wp",\r\n "ProcessId": 9872,\r\n "ThreadId": 31432,\r\n "AppDomainName": null,\r\n "CallStack": null,\r\n "ActivityContext": {\r\n "ActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "SubActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "ParentActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "ClientRequestId": "3bafbd86-e37c-4994-a185-3cdc869903ec",\r\n "ActivityType": "KD.RestClient.ExecuteControlCommand"\r\n },\r\n "ActivityStack": "(Activity stack: CRID=3bafbd86-e37c-4994-a185-3cdc869903ec ARID=3e3b40b3-b690-4cce-abf9-3f17fe53a451 > KD.RestClient.ExecuteControlCommand/3e3b40b3-b690-4cce-abf9-3f17fe53a451)",\r\n "TracingContext": null,\r\n "MonitoredActivityContext": {\r\n "Created": "2026-09-10T12:28:41.1344471Z",\r\n "Activity": {\r\n "ActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "SubActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "ParentActivityId": "3e3b40b3-b690-4cce-abf9-3f17fe53a451",\r\n "ClientRequestId": "3bafbd86-e37c-4994-a185-3cdc869903ec",\r\n "ActivityType": "KD.RestClient.ExecuteControlCommand"\r\n }\r\n },\r\n "ServiceFarm": null,\r\n "TestContext": null\r\n },\r\n "ErrorCode": "SYN0100",\r\n "ErrorReason": "BadRequest",\r\n "ErrorMessage": "Admin commands must have a dot (.) character as their first non-whitespace character",\r\n "DataSource": "https://MYCLUSTER.westeurope.kusto.windows.net/v1/rest/mgmt\",\r\n "DatabaseName": "Hub",\r\n "ClientRequestId": "3bafbd86-e37c-4994-a185-3cdc869903ec",\r\n "ActivityId": "41e8eec1-f4ed-4abe-9f3e-45c07bdca6c4",\r\n "Text": "// Detect most common BillingCurrency in last 7 days\nCosts_v1_2()\n| where ChargePeriodStart >= ago(7d)\n| summarize count() by BillingCurrency\n| top 1 by count",\r\n "ParseErrors": "Admin commands must have a dot (.) character as their first non-whitespace character",\r\n "Line": 0,\r\n "CharacterPositionInLine": 0,\r\n "Token": null\r\n}",
"type": "text"
}
]
}`

Hope this helps

[Roland Krummenacher (RolandKrummenacher)]

Not sure why this doesn't work.
Can you switch to "Run KQL query" connector instead of "Kusto Query MCP Server" and try again?

[DMarshall-1]

sorry still errors

Error Message: The connector 'Azure Data Explorer' returned an HTTP error with code 400. Error Code: ConnectorRequestFailure Conversation Id: 3ec9850d-86d4-4587-924b-d9abb405346a Time (UTC): 2026-09-10T14:29:34.202Z

there is no raw output to copy though.

I tried both dynamically filled via AI and by entering the cluster URI with and without https same error

[Roland Krummenacher (RolandKrummenacher)]

Thanks for testing — and that result is useful, because it rules out my explanation being the whole story.

The MCP trace you sent is solid: DataSource ended in /v1/rest/mgmt with your plain KQL in the Text field, so that path really is misrouted. But the direct Run KQL query action failing too means there's a second problem underneath, and the HTTP 400 alone doesn't tell us what it is.

Three quick tests, cheapest first. Each one splits the problem in half.

1. Is it the connector or the query? Edit the tool and run it with this as the query, nothing else:

print 1

• Works → the connector is fine, and the problem is in the query or the database.
• Still 400 → the connector can't run any query, and the query doesn't matter.

2. Does the query work outside Copilot Studio? Open Azure Data Explorer, connect to your cluster, select the Hub database, and run the exact query, signed in as the same user:

Costs_v1_2()
| where ChargePeriodStart >= ago(7d)
| summarize count() by BillingCurrency
| top 1 by count_

If this fails, the connector was never the issue. One thing to check either way: Costs_v1_2() only exists on FinOps hubs v12 or later. On an older hub the function isn't there, and the query fails no matter how it's sent. You can confirm with .show functions | where Name startswith "Costs".

3. Get the raw 400 body. Copilot Studio swallows the response body, but Power Automate doesn't. Create a flow with a manual trigger and one Run KQL query action from the Azure Data Explorer connector, fill in the same cluster, database, and query, and run it. The run history shows the full request and response, including the real Kusto error. That's the piece that will actually name the cause.

Test 1 and 2 take a couple of minutes each and will probably be enough on their own.

[DMarshall-1]

Print 1 gave me a 400 error as well

Query runs fine in Data Explorer

when I try and save the flow I get

Failed to retrieve dynamic outputs. As a result, this operation's outputs might not be visible in subsequent actions. Error details: The dynamic operation request to API 'kusto' operation 'listKustoResultsSchemaPost' failed with status code 'BadRequest'. This may indicate invalid input parameters. Error response: { "ClassName": "Kusto.Data.Exceptions.SyntaxException", "Message": "clientRequestId: 084edd34-6edb-4dcb-b1f9-af00cfc3c389", "Data": null, "InnerException": null, "HelpURL": null, "StackTraceString": " at Kusto.Data.Net.Client.KustoDataHttpClient.<ThrowKustoExceptionFromResponseMessageAsync>d__1.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsyncImpl>d__72.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.<InvokeAsync>d__122.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at Kusto.Cloud.Platform.Utils.MonitoredActivity.d__122.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Kusto.Data.Net.Client.RestClient2.<MakeHttpRequestAsync>d__69.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at Kusto.Data.Net.Client.RestClient2.<ExecuteControlCommandAsync>d__41.MoveNext()\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.KustoExecutor.KustoExecutor.d__2.MoveNext() in C:\__w\1\s\src\Connectors\FirstParty\kusto\Connector\KustoExecutor\KustoExecutor.cs:line 34\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoProviderBase.<ExecuteControlCommandOrQueryAsync>d__2.MoveNext() in C:\\__w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\Providers\\KustoProviderBase.cs:line 30\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.Providers.KustoSchemaProvider.d__3.MoveNext() in C:\__w\1\s\src\Connectors\FirstParty\kusto\Connector\Providers\KustoSchemaProvider.cs:line 44\r\n--- End of stack trace from previous location where exception was thrown ---\r\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\r\n at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)\r\n at System.Runtime.CompilerServices.ConfiguredTaskAwaitable1.ConfiguredTaskAwaiter.GetResult()\r\n at Microsoft.Azure.Connectors.KustoConnector.Controllers.KustoController.<PostListKustoResultsSchema>d__22.MoveNext() in C:\\__w\\1\\s\\src\\Connectors\\FirstParty\\kusto\\Connector\\Controllers\\KustoController.cs:line 181", "RemoteStackTraceString": null, "RemoteStackIndex": 0, "ExceptionMethod": "8\nMoveNext\nKusto.Data, Version=14.1.2.0, Culture=neutral, PublicKeyToken=829a00acde12d551\nKusto.Data.Net.Client.KustoDataHttpClient+<ThrowKustoExceptionFromResponseMessageAsync>d__1\nVoid MoveNext()", "HResult": -2146233088, "Source": "Kusto.Data", "WatsonBuckets": null, "creationMessage": null, "creationContext": { "Timestamp": "2026-09-10T15:22:47.8231043Z", "ServiceAlias": null, "MachineName": "AW0LDWK0002GI", "ProcessName": "w3wp", "ProcessId": 16420, "ThreadId": 29488, "AppDomainName": null, "CallStack": null, "ActivityContext": { "ActivityId": "995b43c3-1896-4b18-b207-350cefc8491f", "SubActivityId": "995b43c3-1896-4b18-b207-350cefc8491f", "ParentActivityId": "995b43c3-1896-4b18-b207-350cefc8491f", "ClientRequestId": "084edd34-6edb-4dcb-b1f9-af00cfc3c389", "ActivityType": "KD.RestClient.ExecuteControlCommand" }, "ActivityStack": "(Activity stack: CRID=084edd34-6edb-4dcb-b1f9-af00cfc3c389 ARID=995b43c3-1896-4b18-b207-350cefc8491f > KD.RestClient.ExecuteControlCommand/995b43c3-1896-4b18-b207-350cefc8491f)", "TracingContext": null, "MonitoredActivityContext": { "Created": "2026-09-10T15:22:47.8075514Z", "Activity": { "ActivityId": "995b43c3-1896-4b18-b207-350cefc8491f", "SubActivityId": "995b43c3-1896-4b18-b207-350cefc8491f", "ParentActivityId": "995b43c3-1896-4b18-b207-350cefc8491f", "ClientRequestId": "084edd34-6edb-4dcb-b1f9-af00cfc3c389", "ActivityType": "KD.RestClient.ExecuteControlCommand" } }, "ServiceFarm": null, "TestContext": null }, "ErrorCode": "SYN0100", "ErrorReason": "BadRequest", "ErrorMessage": "Admin commands must have a dot (.) character as their first non-whitespace character", "DataSource": "https://MYCLUSTER.westeurope.kusto.windows.net/v1/rest/mgmt", "DatabaseName": "Hub", "ClientRequestId": "084edd34-6edb-4dcb-b1f9-af00cfc3c389", "ActivityId": "2e6a791b-2b06-4977-bb98-89fb6f4214f7", "Text": "Costs_v1_2()\n| where ChargePeriodStart >= ago(7d)\n| summarize count() by BillingCurrency\n| top 1 by count_\n | getschema", "ParseErrors": "Admin commands must have a dot (.) character as their first non-whitespace character", "Line": 0, "CharacterPositionInLine": 0, "Token": null }

[Roland Krummenacher (RolandKrummenacher)]

At this point I'm not sure whether the connector is actually broken. What rights do you have on the database? Can you execute a getschema query in the ADX web ui?

[DMarshall-1]

Hi yes I have full access to the database

I ran

Costs_v1_2
| getschema

without any issues

[Roland Krummenacher (RolandKrummenacher)]

I recommend opening a support ticket.