Skip to content

Commit eca1545

Browse files
author
Jill Grant
authored
Merge pull request #285454 from kainawroth/kainawroth-otel
Updating Application Insights AzMon OTel Distro doc
2 parents eb16086 + 7a09ff8 commit eca1545

File tree

4 files changed

+285
-288
lines changed

4 files changed

+285
-288
lines changed

‎articles/azure-monitor/app/azure-ad-authentication.md

Lines changed: 75 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -17,36 +17,36 @@ Using various authentication systems can be cumbersome and risky because it's di
1717

1818
The following preliminary steps are required to enable Microsoft Entra authenticated ingestion. You need to:
1919

20-
- Be in the public cloud.
21-
- Be familiar with:
22-
- [Managed identity](../../active-directory/managed-identities-azure-resources/overview.md).
23-
- [Service principal](../../active-directory/develop/howto-create-service-principal-portal.md).
24-
- [Assigning Azure roles](../../role-based-access-control/role-assignments-portal.yml).
25-
- Granting access using [Azure built-in roles](../../role-based-access-control/built-in-roles.md) requires having an Owner role to the resource group.
26-
- Understand the [unsupported scenarios](#unsupported-scenarios).
20+
* Be in the public cloud.
21+
* Be familiar with:
22+
* [Managed identity](../../active-directory/managed-identities-azure-resources/overview.md).
23+
* [Service principal](../../active-directory/develop/howto-create-service-principal-portal.md).
24+
* [Assigning Azure roles](../../role-based-access-control/role-assignments-portal.yml).
25+
* Granting access using [Azure built-in roles](../../role-based-access-control/built-in-roles.md) requires having an Owner role to the resource group.
26+
* Understand the [unsupported scenarios](#unsupported-scenarios).
2727

2828
## Unsupported scenarios
2929

3030
The following Software Development Kits (SDKs) and features are unsupported for use with Microsoft Entra authenticated ingestion:
3131

32-
- [Application Insights Java 2.x SDK](deprecated-java-2x.md#monitor-dependencies-caught-exceptions-and-method-execution-times-in-java-web-apps).<br />
32+
* [Application Insights Java 2.x SDK](deprecated-java-2x.md#monitor-dependencies-caught-exceptions-and-method-execution-times-in-java-web-apps).<br />
3333
Microsoft Entra authentication is only available for Application Insights Java Agent greater than or equal to 3.2.0.
34-
- [ApplicationInsights JavaScript web SDK](javascript.md).
35-
- [Application Insights OpenCensus Python SDK](/previous-versions/azure/azure-monitor/app/opencensus-python) with Python version 3.4 and 3.5.
36-
- [AutoInstrumentation for Python on Azure App Service](azure-web-apps-python.md)
37-
- [Profiler](profiler-overview.md).
34+
* [ApplicationInsights JavaScript web SDK](javascript.md).
35+
* [Application Insights OpenCensus Python SDK](/previous-versions/azure/azure-monitor/app/opencensus-python) with Python version 3.4 and 3.5.
36+
* [AutoInstrumentation for Python on Azure App Service](azure-web-apps-python.md)
37+
* [Profiler](profiler-overview.md).
3838

3939
<a name='configure-and-enable-azure-ad-based-authentication'></a>
4040

4141
## Configure and enable Microsoft Entra ID-based authentication
4242

4343
1. If you don't already have an identity, create one by using either a managed identity or a service principal.
4444

45-
- We recommend using a managed identity:
45+
* We recommend using a managed identity:
4646

4747
[Set up a managed identity for your Azure service](../../active-directory/managed-identities-azure-resources/services-support-managed-identities.md) (Virtual Machines or App Service).
4848

49-
- We don't recommend using a service principal:
49+
* We don't recommend using a service principal:
5050

5151
For more information on how to create a Microsoft Entra application and service principal that can access resources, see [Create a service principal](../../active-directory/develop/howto-create-service-principal-portal.md).
5252

@@ -66,11 +66,11 @@ The following Software Development Kits (SDKs) and features are unsupported for
6666
6767
Application Insights .NET SDK supports the credential classes provided by [Azure Identity](https://github.com/Azure/azure-sdk-for-net/tree/master/sdk/identity/Azure.Identity#credential-classes).
6868

69-
- We recommend `DefaultAzureCredential` for local development.
70-
- Authenticate on Visual Studio with the expected Azure user account. For more information, see [Authenticate via Visual Studio](https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/identity/Azure.Identity#authenticate-via-visual-studio).
71-
- We recommend `ManagedIdentityCredential` for system-assigned and user-assigned managed identities.
72-
- For system-assigned, use the default constructor without parameters.
73-
- For user-assigned, provide the client ID to the constructor.
69+
* We recommend `DefaultAzureCredential` for local development.
70+
* Authenticate on Visual Studio with the expected Azure user account. For more information, see [Authenticate via Visual Studio](https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/identity/Azure.Identity#authenticate-via-visual-studio).
71+
* We recommend `ManagedIdentityCredential` for system-assigned and user-assigned managed identities.
72+
* For system-assigned, use the default constructor without parameters.
73+
* For user-assigned, provide the client ID to the constructor.
7474

7575
The following example shows how to manually create and configure `TelemetryConfiguration` by using .NET:
7676

@@ -85,8 +85,8 @@ The following example shows how to configure `TelemetryConfiguration` by using .
8585
```csharp
8686
services.Configure<TelemetryConfiguration>(config =>
8787
{
88-
var credential = new DefaultAzureCredential();
89-
config.SetAzureTokenCredential(credential);
88+
var credential = new DefaultAzureCredential();
89+
config.SetAzureTokenCredential(credential);
9090
});
9191
services.AddApplicationInsightsTelemetry(new ApplicationInsightsServiceOptions
9292
{
@@ -97,29 +97,29 @@ services.AddApplicationInsightsTelemetry(new ApplicationInsightsServiceOptions
9797

9898
Use the `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` environment variable to let Application Insights authenticate to Microsoft Entra ID and send telemetry when using [Azure App Services autoinstrumentation](./azure-web-apps-net-core.md).
9999

100-
- For system-assigned identity:
100+
* For system-assigned identity:
101101

102-
| App setting | Value |
103-
| -------------- |--------- |
104-
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD` |
102+
| App setting | Value |
103+
|-------------------------------------------|---------------------|
104+
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD` |
105105

106-
- For user-assigned identity:
106+
* For user-assigned identity:
107107

108-
| App setting | Value |
109-
| ------------- | -------- |
110-
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD;ClientId={Client id of the User-Assigned Identity}` |
108+
| App setting | Value |
109+
|-------------------------------------------|------------------------------------------------------------------------|
110+
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD;ClientId={Client id of the User-Assigned Identity}` |
111111

112112

113113
### [Node.js](#tab/nodejs)
114114

115115
Azure Monitor OpenTelemetry and Application Insights Node.JS supports the credential classes provided by [Azure Identity](https://github.com/Azure/azure-sdk-for-js/tree/master/sdk/identity/identity#credential-classes).
116116

117-
- We recommend `DefaultAzureCredential` for local development.
118-
- We recommend `ManagedIdentityCredential` for system-assigned and user-assigned managed identities.
119-
- For system-assigned, use the default constructor without parameters.
120-
- For user-assigned, provide the client ID to the constructor.
121-
- We recommend `ClientSecretCredential` for service principals.
122-
- Provide the tenant ID, client ID, and client secret to the constructor.
117+
* We recommend `DefaultAzureCredential` for local development.
118+
* We recommend `ManagedIdentityCredential` for system-assigned and user-assigned managed identities.
119+
* For system-assigned, use the default constructor without parameters.
120+
* For user-assigned, provide the client ID to the constructor.
121+
* We recommend `ClientSecretCredential` for service principals.
122+
* Provide the tenant ID, client ID, and client secret to the constructor.
123123

124124
If using @azure/monitor-opentelemetry
125125
```typescript
@@ -141,6 +141,7 @@ useAzureMonitor(options);
141141
> Support for Microsoft Entra ID in the Application Insights Node.JS is included starting with [version 2.1.0-beta.1](https://www.npmjs.com/package/applicationinsights/v/2.1.0-beta.1).
142142
143143
If using `applicationinsights` npm package.
144+
144145
```typescript
145146
const appInsights = require("applicationinsights");
146147
const { DefaultAzureCredential } = require("@azure/identity");
@@ -155,24 +156,24 @@ appInsights.defaultClient.config.aadTokenCredential = credential;
155156

156157
Use the `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` environment variable to let Application Insights authenticate to Microsoft Entra ID and send telemetry when using [Azure App Services autoinstrumentation](./azure-web-apps-nodejs.md).
157158

158-
- For system-assigned identity:
159+
* For system-assigned identity:
159160

160-
| App setting | Value |
161-
| -------------- |--------- |
162-
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD` |
161+
| App setting | Value |
162+
|-------------------------------------------|---------------------|
163+
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD` |
163164

164-
- For user-assigned identity:
165+
* For user-assigned identity:
165166

166-
| App setting | Value |
167-
| ------------- | -------- |
168-
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD;ClientId={Client id of the User-Assigned Identity}` |
167+
| App setting | Value |
168+
|-------------------------------------------|------------------------------------------------------------------------|
169+
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD;ClientId={Client id of the User-Assigned Identity}` |
169170

170171
### [Java](#tab/java)
171172

172173
> [!NOTE]
173174
> Support for Microsoft Entra ID in the Application Insights Java agent is included starting with [Java 3.2.0-BETA](https://github.com/microsoft/ApplicationInsights-Java/releases/tag/3.2.0-BETA).
174175
175-
1. [Configure your application with the Java agent.](opentelemetry-enable.md?tabs=java#get-started)
176+
1. [Configure your application with the Java agent.](opentelemetry-enable.md?tabs=java#enable-opentelemetry-with-application-insights)
176177

177178
> [!IMPORTANT]
178179
> Use the full connection string, which includes `IngestionEndpoint`, when you configure your app with the Java agent. For example, use `InstrumentationKey=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX;IngestionEndpoint=https://XXXX.applicationinsights.azure.com/`.
@@ -217,17 +218,17 @@ The following example shows how to configure the Java agent to use user-assigned
217218

218219
The `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` environment variable lets Application Insights authenticate to Microsoft Entra ID and send telemetry.
219220

220-
- For system-assigned identity:
221+
* For system-assigned identity:
221222

222-
| App setting | Value |
223-
| -------------- |--------- |
224-
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD` |
223+
| App setting | Value |
224+
|-------------------------------------------|---------------------|
225+
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD` |
225226

226-
- For user-assigned identity:
227+
* For user-assigned identity:
227228

228-
| App setting | Value |
229-
| ------------- | -------- |
230-
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD;ClientId={Client id of the User-Assigned Identity}` |
229+
| App setting | Value |
230+
|-------------------------------------------|------------------------------------------------------------------------|
231+
| APPLICATIONINSIGHTS_AUTHENTICATION_STRING | `Authorization=AAD;ClientId={Client id of the User-Assigned Identity}` |
231232

232233
Set the `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` environment variable using this string.
233234

@@ -291,15 +292,17 @@ Now that your app is registered and has permissions to use the API, grant your a
291292
### Request an authorization token
292293

293294
Before you begin, make sure you have all the values required to make the request successfully. All requests require:
294-
- Your Microsoft Entra tenant ID.
295-
- Your App Insights App ID - If you're currently using API Keys, it's the same app ID.
296-
- Your Microsoft Entra client ID for the app.
297-
- A Microsoft Entra client secret for the app.
295+
296+
* Your Microsoft Entra tenant ID.
297+
* Your App Insights App ID - If you're currently using API Keys, it's the same app ID.
298+
* Your Microsoft Entra client ID for the app.
299+
* A Microsoft Entra client secret for the app.
298300

299301
The Application Insights API supports Microsoft Entra authentication with three different [Microsoft Entra ID OAuth2](/azure/active-directory/develop/active-directory-protocols-oauth-code) flows:
300-
- Client credentials
301-
- Authorization code
302-
- Implicit
302+
303+
* Client credentials
304+
* Authorization code
305+
* Implicit
303306

304307
#### Client credentials flow
305308

@@ -700,15 +703,15 @@ You can disable local authentication by using the Azure portal or Azure Policy o
700703

701704
1. From your Application Insights resource, select **Properties** under **Configure** in the menu on the left. Select **Enabled (click to change)** if the local authentication is enabled.
702705

703-
:::image type="content" source="./media/azure-ad-authentication/enabled.png" alt-text="Screenshot that shows Properties under the Configure section and the Enabled (select to change) local authentication button.":::
706+
:::image type="content" source="./media/azure-ad-authentication/enabled.png" alt-text="Screenshot that shows Properties under the Configure section and the Enabled (select to change) local authentication button.":::
704707

705708
1. Select **Disabled** and apply changes.
706709

707-
:::image type="content" source="./media/azure-ad-authentication/disable.png" alt-text="Screenshot that shows local authentication with the Enabled/Disabled button.":::
710+
:::image type="content" source="./media/azure-ad-authentication/disable.png" alt-text="Screenshot that shows local authentication with the Enabled/Disabled button.":::
708711

709712
1. After disabling local authentication on your resource, you'll see the corresponding information in the **Overview** pane.
710713

711-
:::image type="content" source="./media/azure-ad-authentication/overview.png" alt-text="Screenshot that shows the Overview tab with the Disabled (select to change) local authentication button.":::
714+
:::image type="content" source="./media/azure-ad-authentication/overview.png" alt-text="Screenshot that shows the Overview tab with the Disabled (select to change) local authentication button.":::
712715

713716
### Azure Policy
714717

@@ -824,11 +827,11 @@ The following example shows the Azure Resource Manager template you can use to c
824827

825828
When developing a custom client to obtain an access token from Microsoft Entra ID for submitting telemetry to Application Insights, refer to the following table to determine the appropriate audience string for your particular host environment.
826829

827-
| Azure cloud version | Token audience value |
828-
| --- | --- |
829-
| Azure public cloud | `https://monitor.azure.com` |
830-
| Microsoft Azure operated by 21Vianet cloud | `https://monitor.azure.cn` |
831-
| Azure US Government cloud | `https://monitor.azure.us` |
830+
| Azure cloud version | Token audience value |
831+
|--------------------------------------------|-----------------------------|
832+
| Azure public cloud | `https://monitor.azure.com` |
833+
| Microsoft Azure operated by 21Vianet cloud | `https://monitor.azure.cn` |
834+
| Azure US Government cloud | `https://monitor.azure.us` |
832835

833836
If you're using sovereign clouds, you can find the audience information in the connection string as well. The connection string follows this structure:
834837

@@ -920,8 +923,8 @@ Using Fiddler, you might notice the response `HTTP/1.1 403 Forbidden - provided
920923

921924
The issue could be due to:
922925

923-
- Creating the resource with a system-assigned managed identity or associating a user-assigned identity without adding the Monitoring Metrics Publisher role to it.
924-
- Using the correct credentials for access tokens but linking them to the wrong Application Insights resource. Ensure your resource (virtual machine or app service) or user-assigned identity has Monitoring Metrics Publisher roles in your Application Insights resource.
926+
* Creating the resource with a system-assigned managed identity or associating a user-assigned identity without adding the Monitoring Metrics Publisher role to it.
927+
* Using the correct credentials for access tokens but linking them to the wrong Application Insights resource. Ensure your resource (virtual machine or app service) or user-assigned identity has Monitoring Metrics Publisher roles in your Application Insights resource.
925928

926929
#### Invalid Client ID
927930

@@ -951,6 +954,6 @@ This error usually occurs when the provided credentials don't grant access to in
951954

952955
## Next steps
953956

954-
- [Monitor your telemetry in the portal](overview-dashboard.md)
955-
- [Diagnose with Live Metrics Stream](live-stream.md)
956-
- [Query Application Insights using Microsoft Entra authentication](./app-insights-azure-ad-api.md)
957+
* [Monitor your telemetry in the portal](overview-dashboard.md)
958+
* [Diagnose with Live Metrics Stream](live-stream.md)
959+
* [Query Application Insights using Microsoft Entra authentication](./app-insights-azure-ad-api.md)

0 commit comments

Comments
 (0)