Skip to main content

Setup and administration for CDF Transformations

You can use OpenID Connect and your existing identity provider (IdP) framework to manage access to CDF data securely. We currently support Azure AD, Microsoft's cloud-based identity and access management service.

This article explains how an Azure Active Directory (AD) administrator can control access to CDF Transformations using the organization's IdP.

When you have registered CDF Transformations, users can sign in with their organizational ID to transform data in a CDF project.


CDF projects running in Google Cloud Platform need to be allowlisted to support scheduling of transformations using OpenID Connect. Contact your Cognite representative to be added to the allowlist.

Before you start

Make sure you have registered the Cognite API and the CDF portal application in Azure AD and set up Azure AD and CDF groups to control access to CDF data.


To perform the steps below, you need to be an administrator of Azure AD.

Step 1: Register an app in Azure AD to use with CDF Transformations

  1. Sign in to the Azure portal as an admin.

  2. If you have access to multiple tenants, use the Directory + subscription filter Directory + subscription filter in the top menu to select the tenant in which you want to register an application.

  3. Search for and select Azure Active Directory.

  4. Under Manage, select App registrations > New registrations.

  5. In the Register an application window, enter the app name, and then select Register.

  6. Copy and make a note of the Application (client) ID. This value is required for authentication when reading and writing data in CDF Transformations.

  7. Under Manage, select Certificates & secrets > New client secret.

    OIDC client secret
  8. Enter a client secret description and an expiry time, and then select Add.

  9. Copy and make a note of the client secret in the Value field.


    Make sure you copy this value now. This value will be hidden after you leave this page.

Step 2: Create a group in Azure AD and add the registered app as its member

  1. Open the overview window in Azure AD and select Manage > Groups.

  2. Create a group.

  3. Open the group. Under Manage, select Members > Add members.

  4. Find the app you created above and click Select.

  5. Add all users you want to have access to CDF Transformations as members.

  6. Return to the overview, and then copy and make a note of the Object Id.

    OIDC Add app to group
  1. Sign in to Cognite Data Fusion as an admin.

  2. In the top menu, select Manage & Configure > Manage access to open the Access management window.

  3. On the Groups tab, select Create new group and enter a unique name for the group.

  4. Add read and write capabilities accordingly for the CDF resources you want to read and write using transformations. For instance, if you are transforming the data in RAW and writing the data to assets, you must add raw:read and asset:write capabilities.

    Minimum required capabilities

    The minimum requirement is to add project:list, groups:list, transformations:read, transformations:write, and session:create.

  5. Click Create.

  6. Open the OpenID connect tab and insert your token_url. The token_url contains the ID of your Azure AD tenant. To find your tenant ID, see this article.

    Running scheduled transformations

    To schedule transformations, you must add the capability session:create and set the token_url to maintain access to CDF Transformations for an extended time period.

  7. Link the Transformations group to an Azure AD group:

    1. In the Source ID field, enter the Object Id for the AAD group exactly as it exists in AAD. You can use the same group Id for multiple transformations.

    2. In the Source name field, enter the name of the group in Azure AD.

Step 4: Run transformations

  1. Verify that the configuration is successful by following the steps in this article.


    Transformations with the same Client ID run as the same user with the same access. This ID and the Client secret must be given before a user can schedule and run transformations.