Skip to content

Commit 73f4ae1

Browse files
AarDavMaxAarDavMax
committed
Moving disable local auth heading down
1 parent 21e2012 commit 73f4ae1

File tree

1 file changed

+146
-146
lines changed

1 file changed

+146
-146
lines changed

‎articles/azure-monitor/app/azure-ad-authentication.md

Lines changed: 146 additions & 146 deletions
Original file line numberDiff line numberDiff line change
@@ -242,152 +242,6 @@ tracer = Tracer(
242242

243243
---
244244

245-
## Disable local authentication
246-
247-
After the Microsoft Entra authentication is enabled, you can choose to disable local authentication. This configuration allows you to ingest telemetry authenticated exclusively by Microsoft Entra ID and affects data access (for example, through API keys).
248-
249-
You can disable local authentication by using the Azure portal or Azure Policy or programmatically.
250-
251-
### Azure portal
252-
253-
1. From your Application Insights resource, select **Properties** under **Configure** in the menu on the left. Select **Enabled (click to change)** if the local authentication is enabled.
254-
255-
:::image type="content" source="./media/azure-ad-authentication/enabled.png" alt-text="Screenshot that shows Properties under the Configure section and the Enabled (select to change) local authentication button.":::
256-
257-
1. Select **Disabled** and apply changes.
258-
259-
:::image type="content" source="./media/azure-ad-authentication/disable.png" alt-text="Screenshot that shows local authentication with the Enabled/Disabled button.":::
260-
261-
1. After disabling local authentication on your resource, you'll see the corresponding information in the **Overview** pane.
262-
263-
:::image type="content" source="./media/azure-ad-authentication/overview.png" alt-text="Screenshot that shows the Overview tab with the Disabled (select to change) local authentication button.":::
264-
265-
### Azure Policy
266-
267-
Azure Policy for `DisableLocalAuth` denies users the ability to create a new Application Insights resource without this property set to `true`. The policy name is `Application Insights components should block non-AAD auth ingestion`.
268-
269-
To apply this policy definition to your subscription, [create a new policy assignment and assign the policy](../../governance/policy/assign-policy-portal.md).
270-
271-
The following example shows the policy template definition:
272-
273-
```JSON
274-
{
275-
"properties": {
276-
"displayName": "Application Insights components should block non-AAD auth ingestion",
277-
"policyType": "BuiltIn",
278-
"mode": "Indexed",
279-
"description": "Improve Application Insights security by disabling log ingestion that are not AAD-based.",
280-
"metadata": {
281-
"version": "1.0.0",
282-
"category": "Monitoring"
283-
},
284-
"parameters": {
285-
"effect": {
286-
"type": "String",
287-
"metadata": {
288-
"displayName": "Effect",
289-
"description": "The effect determines what happens when the policy rule is evaluated to match"
290-
},
291-
"allowedValues": [
292-
"audit",
293-
"deny",
294-
"disabled"
295-
],
296-
"defaultValue": "audit"
297-
}
298-
},
299-
"policyRule": {
300-
"if": {
301-
"allOf": [
302-
{
303-
"field": "type",
304-
"equals": "Microsoft.Insights/components"
305-
},
306-
{
307-
"field": "Microsoft.Insights/components/DisableLocalAuth",
308-
"notEquals": "true"
309-
}
310-
]
311-
},
312-
"then": {
313-
"effect": "[parameters('effect')]"
314-
}
315-
}
316-
}
317-
}
318-
```
319-
320-
### Programmatic enablement
321-
322-
The property `DisableLocalAuth` is used to disable any local authentication on your Application Insights resource. When this property is set to `true`, it enforces that Microsoft Entra authentication must be used for all access.
323-
324-
The following example shows the Azure Resource Manager template you can use to create a workspace-based Application Insights resource with `LocalAuth` disabled.
325-
326-
```JSON
327-
{
328-
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
329-
"contentVersion": "1.0.0.0",
330-
"parameters": {
331-
"name": {
332-
"type": "string"
333-
},
334-
"type": {
335-
"type": "string"
336-
},
337-
"regionId": {
338-
"type": "string"
339-
},
340-
"tagsArray": {
341-
"type": "object"
342-
},
343-
"requestSource": {
344-
"type": "string"
345-
},
346-
"workspaceResourceId": {
347-
"type": "string"
348-
},
349-
"disableLocalAuth": {
350-
"type": "bool"
351-
}
352-
353-
},
354-
"resources": [
355-
{
356-
"name": "[parameters('name')]",
357-
"type": "microsoft.insights/components",
358-
"location": "[parameters('regionId')]",
359-
"tags": "[parameters('tagsArray')]",
360-
"apiVersion": "2020-02-02-preview",
361-
"dependsOn": [],
362-
"properties": {
363-
"Application_Type": "[parameters('type')]",
364-
"Flow_Type": "Redfield",
365-
"Request_Source": "[parameters('requestSource')]",
366-
"WorkspaceResourceId": "[parameters('workspaceResourceId')]",
367-
"DisableLocalAuth": "[parameters('disableLocalAuth')]"
368-
}
369-
}
370-
]
371-
}
372-
373-
```
374-
375-
### Token audience
376-
377-
When developing a custom client to obtain an access token from Microsoft Entra ID for submitting telemetry to Application Insights, refer to the following table to determine the appropriate audience string for your particular host environment.
378-
379-
| Azure cloud version | Token audience value |
380-
| --- | --- |
381-
| Azure public cloud | `https://monitor.azure.com` |
382-
| Microsoft Azure operated by 21Vianet cloud | `https://monitor.azure.cn` |
383-
| Azure US Government cloud | `https://monitor.azure.us` |
384-
385-
If you're using sovereign clouds, you can find the audience information in the connection string as well. The connection string follows this structure:
386-
387-
*InstrumentationKey={profile.InstrumentationKey};IngestionEndpoint={ingestionEndpoint};LiveEndpoint={liveDiagnosticsEndpoint};AADAudience={aadAudience}*
388-
389-
The audience parameter, AADAudience, can vary depending on your specific environment.
390-
391245
## Query Application Insights using Microsoft Entra authentication
392246

393247
You can submit a query request by using the Azure Monitor Application Insights endpoint `https://api.applicationinsights.io`. To access the endpoint, you must authenticate through Microsoft Entra ID.
@@ -825,6 +679,152 @@ A successful request produces a redirect to your redirect URI with the token in
825679

826680
This access\_token serves as the `Authorization: Bearer` header value when it passes to the Application Insights API to authorize requests.
827681

682+
## Disable local authentication
683+
684+
After the Microsoft Entra authentication is enabled, you can choose to disable local authentication. This configuration allows you to ingest telemetry authenticated exclusively by Microsoft Entra ID and affects data access (for example, through API keys).
685+
686+
You can disable local authentication by using the Azure portal or Azure Policy or programmatically.
687+
688+
### Azure portal
689+
690+
1. From your Application Insights resource, select **Properties** under **Configure** in the menu on the left. Select **Enabled (click to change)** if the local authentication is enabled.
691+
692+
:::image type="content" source="./media/azure-ad-authentication/enabled.png" alt-text="Screenshot that shows Properties under the Configure section and the Enabled (select to change) local authentication button.":::
693+
694+
1. Select **Disabled** and apply changes.
695+
696+
:::image type="content" source="./media/azure-ad-authentication/disable.png" alt-text="Screenshot that shows local authentication with the Enabled/Disabled button.":::
697+
698+
1. After disabling local authentication on your resource, you'll see the corresponding information in the **Overview** pane.
699+
700+
:::image type="content" source="./media/azure-ad-authentication/overview.png" alt-text="Screenshot that shows the Overview tab with the Disabled (select to change) local authentication button.":::
701+
702+
### Azure Policy
703+
704+
Azure Policy for `DisableLocalAuth` denies users the ability to create a new Application Insights resource without this property set to `true`. The policy name is `Application Insights components should block non-AAD auth ingestion`.
705+
706+
To apply this policy definition to your subscription, [create a new policy assignment and assign the policy](../../governance/policy/assign-policy-portal.md).
707+
708+
The following example shows the policy template definition:
709+
710+
```JSON
711+
{
712+
"properties": {
713+
"displayName": "Application Insights components should block non-AAD auth ingestion",
714+
"policyType": "BuiltIn",
715+
"mode": "Indexed",
716+
"description": "Improve Application Insights security by disabling log ingestion that are not AAD-based.",
717+
"metadata": {
718+
"version": "1.0.0",
719+
"category": "Monitoring"
720+
},
721+
"parameters": {
722+
"effect": {
723+
"type": "String",
724+
"metadata": {
725+
"displayName": "Effect",
726+
"description": "The effect determines what happens when the policy rule is evaluated to match"
727+
},
728+
"allowedValues": [
729+
"audit",
730+
"deny",
731+
"disabled"
732+
],
733+
"defaultValue": "audit"
734+
}
735+
},
736+
"policyRule": {
737+
"if": {
738+
"allOf": [
739+
{
740+
"field": "type",
741+
"equals": "Microsoft.Insights/components"
742+
},
743+
{
744+
"field": "Microsoft.Insights/components/DisableLocalAuth",
745+
"notEquals": "true"
746+
}
747+
]
748+
},
749+
"then": {
750+
"effect": "[parameters('effect')]"
751+
}
752+
}
753+
}
754+
}
755+
```
756+
757+
### Programmatic enablement
758+
759+
The property `DisableLocalAuth` is used to disable any local authentication on your Application Insights resource. When this property is set to `true`, it enforces that Microsoft Entra authentication must be used for all access.
760+
761+
The following example shows the Azure Resource Manager template you can use to create a workspace-based Application Insights resource with `LocalAuth` disabled.
762+
763+
```JSON
764+
{
765+
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
766+
"contentVersion": "1.0.0.0",
767+
"parameters": {
768+
"name": {
769+
"type": "string"
770+
},
771+
"type": {
772+
"type": "string"
773+
},
774+
"regionId": {
775+
"type": "string"
776+
},
777+
"tagsArray": {
778+
"type": "object"
779+
},
780+
"requestSource": {
781+
"type": "string"
782+
},
783+
"workspaceResourceId": {
784+
"type": "string"
785+
},
786+
"disableLocalAuth": {
787+
"type": "bool"
788+
}
789+
790+
},
791+
"resources": [
792+
{
793+
"name": "[parameters('name')]",
794+
"type": "microsoft.insights/components",
795+
"location": "[parameters('regionId')]",
796+
"tags": "[parameters('tagsArray')]",
797+
"apiVersion": "2020-02-02-preview",
798+
"dependsOn": [],
799+
"properties": {
800+
"Application_Type": "[parameters('type')]",
801+
"Flow_Type": "Redfield",
802+
"Request_Source": "[parameters('requestSource')]",
803+
"WorkspaceResourceId": "[parameters('workspaceResourceId')]",
804+
"DisableLocalAuth": "[parameters('disableLocalAuth')]"
805+
}
806+
}
807+
]
808+
}
809+
810+
```
811+
812+
### Token audience
813+
814+
When developing a custom client to obtain an access token from Microsoft Entra ID for submitting telemetry to Application Insights, refer to the following table to determine the appropriate audience string for your particular host environment.
815+
816+
| Azure cloud version | Token audience value |
817+
| --- | --- |
818+
| Azure public cloud | `https://monitor.azure.com` |
819+
| Microsoft Azure operated by 21Vianet cloud | `https://monitor.azure.cn` |
820+
| Azure US Government cloud | `https://monitor.azure.us` |
821+
822+
If you're using sovereign clouds, you can find the audience information in the connection string as well. The connection string follows this structure:
823+
824+
*InstrumentationKey={profile.InstrumentationKey};IngestionEndpoint={ingestionEndpoint};LiveEndpoint={liveDiagnosticsEndpoint};AADAudience={aadAudience}*
825+
826+
The audience parameter, AADAudience, can vary depending on your specific environment.
827+
828828
## Troubleshooting
829829

830830
This section provides distinct troubleshooting scenarios and steps that you can take to resolve an issue before you raise a support ticket.

0 commit comments

Comments
 (0)