Is there a way to use workload identity (or managed identity) to authenticate OTEL against Azure Application Insights?

[joshuadmatthews]

I have a policy that requires local authentication to be disabled for Application Insights. With that disabled, the instrumentation key alone will not allow access, I need to ensure calls are coming from an identity with Monitoring Metrics Publisher role. Is there any way to accomplish this?

[brunobat]

CC @jeanbisutti

[jeanbisutti]

@joshuadmatthews

You could perhaps configure the connection string at runtime and do some verifications at this step: https://learn.microsoft.com/en-us/azure/azure-monitor/app/java-standalone-config#connection-string-configured-at-runtime

If you need more assistance, could you please create a Github issue in https://github.com/microsoft/ApplicationInsights-Java?

[joshuadmatthews]

I don’t think the connection string is sufficient, managed identity would require fetching tokens from Entra and attaching them to the telemetry requests.

[jeanbisutti]

@joshuadmatthews

It's perhaps what you need: https://learn.microsoft.com/en-us/azure/azure-monitor/app/azure-ad-authentication?tabs=java

[joshuadmatthews]

Yes, but I need OTEL to support that.

[jeanbisutti]

@joshuadmatthews

It's perhaps what you are looking for: https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/azuremonitorexporter/AUTHENTICATION.md#aadentra-authentication