Microsoft Entra authentication for Application Insights

Application Insights now supports Microsoft Entra authentication. By using Microsoft Entra ID, you can ensure that only authenticated telemetry is ingested in your Application Insights resources.

Using various authentication systems can be cumbersome and risky because it's difficult to manage credentials at scale. You can now choose to opt out of local authentication to ensure only telemetry exclusively authenticated by using managed identities and Microsoft Entra ID is ingested in your resource.

This feature enhances the security and reliability of the telemetry used to make critical operational (alerting and autoscaling) and business decisions.

Prerequisites

To enable Microsoft Entra authenticated ingestion, complete the following steps:

Be familiar with Managed identity, Service principal, and Assigning Azure roles.
Have an Owner role to the resource group, required for granting access by using Azure built-in roles.
Understand the unsupported scenarios.

Unsupported scenarios

The following Software Development Kits (SDKs) and features don't support use with Microsoft Entra authenticated ingestion:

Application Insights Java 2.x SDK. Microsoft Entra authentication is only available for Application Insights Java Agent greater than or equal to 3.2.0.
Application Insights JavaScript SDK.
Application Insights OpenCensus Python SDK (retired) with Python version 3.4 and 3.5.
Automatic instrumentation for Python on Azure App Service.

Configure and enable Microsoft Entra ID-based authentication

Create an identity by using a managed identity or a service principal if you don't already have one. Use a managed identity when one is available.
- Use a managed identity:
  
  Set up a managed identity for your Azure service (Virtual Machines or App Service).
- Use a service principal if your SDK supports it:
  
  For more information about how to create a Microsoft Entra application and service principal that can access resources, see Create a service principal.
Assign the required role to the Azure identity, service principal, or Azure user account.

Follow the steps in Assign Azure roles to add the Monitoring Metrics Publisher role to the expected identity, service principal, or Azure user account by setting the target Application Insights resource as the role scope.

Note

Although the Monitoring Metrics Publisher role says "metrics," it publishes all telemetry to the Application Insights resource.
Follow the configuration guidance in accordance with the language that follows.
- ASP.NET Core
- .NET
- Java
- Java native
- Node.js
- Python
Note
- Support for Microsoft Entra ID in the Application Insights .NET SDK is included starting with version 2.18-Beta3.
- The SDK supports the credential classes provided by Azure Identity.
Prerequisites
- Use DefaultAzureCredential for local development.
- Sign in to Visual Studio by using the expected Azure user account. For more information, see Authenticate via Visual Studio.
- Use ManagedIdentityCredential for system-assigned and user-assigned managed identities.
  - For system-assigned, use the default constructor without parameters.
  - For user-assigned, provide the client ID to the constructor.
Configuration guidance
1. Install the latest Azure.Identity package.
```
dotnet add package Azure.Identity
```
2. Provide the desired credential class.
```
// Create a new ASP.NET Core web application builder.
var builder = WebApplication.CreateBuilder(args);

// Add the OpenTelemetry telemetry service to the application.
// This service will collect and send telemetry data to Azure Monitor.
builder.Services.AddOpenTelemetry().UseAzureMonitor(options => {
    // Set the Azure Monitor credential to the DefaultAzureCredential.
    // This credential will use the Azure identity of the current user or
    // the service principal that the application is running as to authenticate
    // to Azure Monitor.
    options.Credential = new DefaultAzureCredential();
});

// Build the ASP.NET Core web application.
var app = builder.Build();

// Start the ASP.NET Core web application.
app.Run();
```
Environment variable configuration

Use the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable to let Application Insights authenticate to Microsoft Entra ID and send telemetry when using Azure App Services autoinstrumentation and Configure monitoring for Azure Functions.
- System-assigned identity:
  
  App setting Value
  
  APPLICATIONINSIGHTS_AUTHENTICATION_STRING Authorization=AAD
- User-assigned identity:
  
  App setting Value
  
  APPLICATIONINSIGHTS_AUTHENTICATION_STRING Authorization=AAD;ClientId={Client id of the User-Assigned Identity}
Note
- Support for Microsoft Entra ID in the Application Insights .NET SDK is included starting with version 2.18-Beta3.
- The SDK supports the credential classes provided by Azure Identity.
Prerequisites
- Use DefaultAzureCredential for local development.
- Sign in to Visual Studio by using the expected Azure user account. For more information, see Authenticate via Visual Studio.
- Use ManagedIdentityCredential for system-assigned and user-assigned managed identities.
  - For system-assigned, use the default constructor without parameters.
  - For user-assigned, provide the client ID to the constructor.
Configuration guidance
1. Install the latest Azure.Identity package.
```
dotnet add package Azure.Identity
```
2. Provide the desired credential class.
```
// Create a DefaultAzureCredential.
var credential = new DefaultAzureCredential();

// Create a new OpenTelemetry tracer provider and set the credential.
// It is important to keep the TracerProvider instance active throughout the process lifetime.
var tracerProvider = Sdk.CreateTracerProviderBuilder()
    .AddAzureMonitorTraceExporter(options =>
    {
        options.Credential = credential;
    })
    .Build();

// Create a new OpenTelemetry meter provider and set the credential.
// It is important to keep the MetricsProvider instance active throughout the process lifetime.
var metricsProvider = Sdk.CreateMeterProviderBuilder()
    .AddAzureMonitorMetricExporter(options =>
    {
        options.Credential = credential;
    })
    .Build();

// Create a new logger factory and add the OpenTelemetry logger provider with the credential.
// It is important to keep the LoggerFactory instance active throughout the process lifetime.
var loggerFactory = LoggerFactory.Create(builder =>
{
    builder.AddOpenTelemetry(logging =>
    {
        logging.AddAzureMonitorLogExporter(options =>
        {
            options.Credential = credential;
        });
    });
});
```
Environment variable configuration

Use the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable to let Application Insights authenticate to Microsoft Entra ID and send telemetry when using Azure App Services autoinstrumentation.
- System-assigned identity:
  
  App setting Value
  
  APPLICATIONINSIGHTS_AUTHENTICATION_STRING Authorization=AAD
- User-assigned identity:
  
  App setting Value
  
  APPLICATIONINSIGHTS_AUTHENTICATION_STRING Authorization=AAD;ClientId={Client id of the User-Assigned Identity}
Note
- The Application Insights Java agent supports Microsoft Entra ID starting with Java 3.2.0-BETA.
- For Java agent configuration options, see Configure the Java agent.
Prerequisites
- Use Application Insights Java agent 3.2.0 or later.
- Configure a system-assigned or user-assigned managed identity for the Azure service running your application. Assign it the Monitoring Metrics Publisher role on your Application Insights resource.
- Have the full Application Insights connection string, including IngestionEndpoint.
Configuration guidance
1. Configure your application with the Java agent.
  
  Important
  
  Use the full connection string, which includes IngestionEndpoint, when you configure your app with the Java agent. For example, use InstrumentationKey=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX;IngestionEndpoint=https://XXXX.applicationinsights.azure.com/.
2. Add the JSON configuration to the ApplicationInsights.json configuration file depending on the authentication you're using. Use managed identities for authentication.
Environment variable configuration

The APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable enables Application Insights to authenticate with Microsoft Entra ID and send telemetry. Configure it based on the type of identity you're using:
- System-assigned identity:
  
  Set the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable to:
```
Authorization=AAD
```
- User-assigned identity:
  
  Set the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable to:
```
Authorization=AAD;ClientId={Client id of the User-Assigned Identity}
```
  Replace {Client id of the User-Assigned Identity} with the actual client ID of your user-assigned identity.
Set the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable using this string.
- In Unix/Linux:
```
export APPLICATIONINSIGHTS_AUTHENTICATION_STRING="Authorization=AAD"
```
- In Windows:
```
set APPLICATIONINSIGHTS_AUTHENTICATION_STRING="Authorization=AAD"
```
After setting it, restart your application. It now sends telemetry to Application Insights using Microsoft Entra authentication.

Manual configuration
Note
- For more information about migrating from the 2.X SDK to the 3.X Java agent, see Upgrading from Application Insights Java 2.x SDK.
- For more information about Java, see the Java supplemental documentation.
System-assigned managed identity:

The following example shows how to configure the Java agent to use system-assigned managed identity for authentication with Microsoft Entra ID.
```
{
  "connectionString": "App Insights Connection String with IngestionEndpoint",
  "authentication": {
    "enabled": true,
    "type": "SAMI"
  }
}
```
User-assigned managed identity:

The following example shows how to configure the Java agent to use user-assigned managed identity for authentication with Microsoft Entra ID.
```
{
  "connectionString": "App Insights Connection String with IngestionEndpoint",
  "authentication": {
    "enabled": true,
    "type": "UAMI",
    "clientId":"<USER-ASSIGNED MANAGED IDENTITY CLIENT ID>"
  }
}
```
Microsoft Entra ID authentication isn't available for GraalVM Native applications.
Note
- Support for Microsoft Entra ID in the Application Insights Node.js SDK is included starting with version 2.1.0-beta.1.
- The SDK supports the credential classes provided by Azure Identity.
Prerequisites
- Use DefaultAzureCredential for local development.
- Use ManagedIdentityCredential for system-assigned and user-assigned managed identities.
  - For system-assigned, use the default constructor without parameters.
  - For user-assigned, provide the client ID to the constructor.
- Use ClientSecretCredential for service principals.
  - Provide the tenant ID, client ID, and client secret to the constructor.
Environment variable configuration

Use the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable to let Application Insights authenticate to Microsoft Entra ID and send telemetry when using Azure App Service monitoring without code changes.
- For system-assigned identity:
App setting Value

APPLICATIONINSIGHTS_AUTHENTICATION_STRING Authorization=AAD
- For user-assigned identity:
App setting Value

APPLICATIONINSIGHTS_AUTHENTICATION_STRING Authorization=AAD;ClientId={Client id of the User-Assigned Identity}

Manual configuration

The following sample applies when using @azure/monitor-opentelemetry:
```
// Import the useAzureMonitor function, the AzureMonitorOpenTelemetryOptions class, and the ManagedIdentityCredential class from the @azure/monitor-opentelemetry and @azure/identity packages, respectively.
const { useAzureMonitor, AzureMonitorOpenTelemetryOptions } = require("@azure/monitor-opentelemetry");
const { ManagedIdentityCredential } = require("@azure/identity");

// Create a new ManagedIdentityCredential object.
const credential = new ManagedIdentityCredential();

// Create a new AzureMonitorOpenTelemetryOptions object and set the credential property to the credential object.
const options: AzureMonitorOpenTelemetryOptions = {
    azureMonitorExporterOptions: {
        connectionString:
            process.env["APPLICATIONINSIGHTS_CONNECTION_STRING"] || "<your connection string>",
        credential: credential
    }
};

// Enable Azure Monitor integration using the useAzureMonitor function and the AzureMonitorOpenTelemetryOptions object.
useAzureMonitor(options);
```
The following sample applies when using applicationinsights npm package.
```
// Import the applicationinsights module and the DefaultAzureCredential class from the @azure/identity package.
const appInsights = require("applicationinsights");
const { DefaultAzureCredential } = require("@azure/identity");

// Create a new DefaultAzureCredential object to authenticate with Azure Active Directory.
const credential = new DefaultAzureCredential();

// Set up Application Insights with a connection string, then start the Application Insights client.
appInsights.setup("InstrumentationKey=00000000-0000-0000-0000-000000000000;IngestionEndpoint=https://xxxx.applicationinsights.azure.com/").start();

// Assign the DefaultAzureCredential object to the aadTokenCredential property of the default Application Insights client configuration for authentication.
appInsights.defaultClient.config.aadTokenCredential = credential;
```
Note
- The SDK supports the credential classes provided by Azure Identity.
- We provide information on configuring OpenCensus (retired) separately. See Configure and enable Microsoft Entra ID-based authentication.
Prerequisites
- Use DefaultAzureCredential for local development.
- Use ManagedIdentityCredential for system-assigned and user-assigned managed identities.
  - For system-assigned, use the default constructor without parameters.
  - For user-assigned, provide the client_id to the constructor.
- Use ClientSecretCredential for service principals.
  - Provide the tenant ID, client ID, and client secret to the constructor.
Configuration guidance
- If you're using ManagedIdentityCredential:
```
# Import the `ManagedIdentityCredential` class from the `azure.identity` package.
from azure.identity import ManagedIdentityCredential
# Import the `configure_azure_monitor()` function from the `azure.monitor.opentelemetry` package.
from azure.monitor.opentelemetry import configure_azure_monitor
from opentelemetry import trace

# Configure the Distro to authenticate with Azure Monitor using a managed identity credential.
credential = ManagedIdentityCredential(client_id="<client_id>")
configure_azure_monitor(
    connection_string="your-connection-string",
    credential=credential,
)

tracer = trace.get_tracer(__name__)

with tracer.start_as_current_span("hello with aad managed identity"):
    print("Hello, World!")
```
- If you're using ClientSecretCredential:
```
# Import the `ClientSecretCredential` class from the `azure.identity` package.
from azure.identity import ClientSecretCredential
# Import the `configure_azure_monitor()` function from the `azure.monitor.opentelemetry` package.
from azure.monitor.opentelemetry import configure_azure_monitor
from opentelemetry import trace

# Configure the Distro to authenticate with Azure Monitor using a client secret credential.
credential = ClientSecretCredential(
    tenant_id="<tenant_id",
    client_id="<client_id>",
    client_secret="<client_secret>",
)
configure_azure_monitor(
    connection_string="your-connection-string",
    credential=credential,
)

with tracer.start_as_current_span("hello with aad client secret identity"):
    print("Hello, World!")
```

App setting	Value
APPLICATIONINSIGHTS_AUTHENTICATION_STRING	`Authorization=AAD`

App setting	Value
APPLICATIONINSIGHTS_AUTHENTICATION_STRING	`Authorization=AAD;ClientId={Client id of the User-Assigned Identity}`

App setting	Value
APPLICATIONINSIGHTS_AUTHENTICATION_STRING	`Authorization=AAD`

App setting	Value
APPLICATIONINSIGHTS_AUTHENTICATION_STRING	`Authorization=AAD;ClientId={Client id of the User-Assigned Identity}`

App setting	Value
APPLICATIONINSIGHTS_AUTHENTICATION_STRING	`Authorization=AAD`

App setting	Value
APPLICATIONINSIGHTS_AUTHENTICATION_STRING	`Authorization=AAD;ClientId={Client id of the User-Assigned Identity}`

Query Application Insights by using Microsoft Entra authentication

You can submit a query request by using the Azure Monitor Application Insights endpoint https://api.applicationinsights.io. To access the endpoint, you must authenticate through Microsoft Entra ID.

Set up authentication

To access the API, register a client app with Microsoft Entra ID and request a token.

Register an app in Microsoft Entra ID.
On the app's overview page, select API permissions.
Select Add a permission.
On the APIs my organization uses tab, search for Application Insights and select Application Insights API from the list.
Select Delegated permissions.
Select the Data.Read checkbox.
Select Add permissions.

After you register your app and grant it permissions to use the API, grant your app access to your Application Insights resource.

From your Application Insights resource overview page, select Access control (IAM).
Select Add role assignment.
Select the Reader role and then select Members.
On the Members tab, choose Select members.
Enter the name of your app in the Select box.
Select your app and choose Select.
Select Review + assign.
After you finish the Active Directory setup and permissions, request an authorization token.

Note

For this example, use the Reader role. This role is one of many built-in roles and might include more permissions than you require. You can create more granular roles and permissions.

Request an authorization token

Before you begin, make sure you have all the values required to make the request successfully. All requests require:

Your Microsoft Entra tenant ID.
Your App Insights App ID - If you're currently using API Keys, it's the same app ID.
Your Microsoft Entra client ID for the app.
A Microsoft Entra client secret for the app.

The Application Insights API supports Microsoft Entra authentication with three different Microsoft Entra ID OAuth2 flows:

Client credentials
Authorization code
Implicit

URL-encode values in query strings and form-encoded request bodies.

Client credentials flow

In the client credentials flow, use the token with the Application Insights endpoint. Make a single request to receive a token by using the credentials you provide for your app when you register an app in Microsoft Entra ID.

Use the https://api.applicationinsights.io endpoint.

Client credentials token URL (POST request)

The following REST example uses the Microsoft Entra client credentials flow to request a token. The request body is form-encoded, not JSON.

POST https://login.microsoftonline.com/{tenantId}/oauth2/token
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=<ClientId>&resource=https://api.applicationinsights.io&client_secret=<ClientSecret>

A successful request receives an access token in the response:

{
  "token_type": "Bearer",
  "expires_in": "86399",
  "ext_expires_in": "86399",
  "access_token": "eyJ0eXAiOiJKV1QiLCJ.....Ax"
}

The following REST example uses the Query - Execute REST API operation. It queries requests over a one-day timespan by using the access token.

POST https://api.applicationinsights.io/v1/apps/{appId}/query
Authorization: Bearer {accessToken}
Host: api.applicationinsights.io
Content-Type: application/json

{
  "query": "requests | take 10",
  "timespan": "P1D"
}

Response example:

View the Application Insights query response

{
  "tables": [
    {
      "name": "PrimaryResult",
      "columns": [
        {
          "name": "timestamp",
          "type": "datetime"
        },
        {
          "name": "id",
          "type": "string"
        },
        {
          "name": "source",
          "type": "string"
        },
        {
          "name": "name",
          "type": "string"
        },
        {
          "name": "url",
          "type": "string"
        },
        {
          "name": "success",
          "type": "string"
        },
        {
          "name": "resultCode",
          "type": "string"
        },
        {
          "name": "duration",
          "type": "real"
        },
        {
          "name": "performanceBucket",
          "type": "string"
        },
        {
          "name": "customDimensions",
          "type": "dynamic"
        },
        {
          "name": "customMeasurements",
          "type": "dynamic"
        },
        {
          "name": "operation_Name",
          "type": "string"
        },
        {
          "name": "operation_Id",
          "type": "string"
        },
        {
          "name": "operation_ParentId",
          "type": "string"
        },
        {
          "name": "operation_SyntheticSource",
          "type": "string"
        },
        {
          "name": "session_Id",
          "type": "string"
        },
        {
          "name": "user_Id",
          "type": "string"
        },
        {
          "name": "user_AuthenticatedId",
          "type": "string"
        },
        {
          "name": "user_AccountId",
          "type": "string"
        },
        {
          "name": "application_Version",
          "type": "string"
        },
        {
          "name": "client_Type",
          "type": "string"
        },
        {
          "name": "client_Model",
          "type": "string"
        },
        {
          "name": "client_OS",
          "type": "string"
        },
        {
          "name": "client_IP",
          "type": "string"
        },
        {
          "name": "client_City",
          "type": "string"
        },
        {
          "name": "client_StateOrProvince",
          "type": "string"
        },
        {
          "name": "client_CountryOrRegion",
          "type": "string"
        },
        {
          "name": "client_Browser",
          "type": "string"
        },
        {
          "name": "cloud_RoleName",
          "type": "string"
        },
        {
          "name": "cloud_RoleInstance",
          "type": "string"
        },
        {
          "name": "appId",
          "type": "string"
        },
        {
          "name": "appName",
          "type": "string"
        },
        {
          "name": "iKey",
          "type": "string"
        },
        {
          "name": "sdkVersion",
          "type": "string"
        },
        {
          "name": "itemId",
          "type": "string"
        },
        {
          "name": "itemType",
          "type": "string"
        },
        {
          "name": "itemCount",
          "type": "int"
        }
      ],
      "rows": [
        [
          "2018-02-01T17:33:09.788Z",
          "|0qRud6jz3k0=.c32c2659_",
          null,
          "GET Reports/Index",
          "http://fabrikamfiberapp.azurewebsites.net/Reports",
          "True",
          "200",
          "3.3833",
          "<250ms",
          "{\"_MS.ProcessedByMetricExtractors\":\"(Name:'Requests', Ver:'1.0')\"}",
          null,
          "GET Reports/Index",
          "0qRud6jz3k0=",
          "0qRud6jz3k0=",
          "Application Insights Availability Monitoring",
          "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
          "us-va-ash-azr_aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
          null,
          null,
          "AutoGen_49c3aea0-4641-4675-93b5-55f7a62d22d3",
          "PC",
          null,
          null,
          "52.168.8.0",
          "Boydton",
          "Virginia",
          "United States",
          null,
          "fabrikamfiberapp",
          "RD00155D5053D1",
          "bbbbbbbb-1111-2222-3333-cccccccccccc",
          "fabrikamprod",
          "cccccccc-2222-3333-4444-dddddddddddd",
          "web:2.5.0-33031",
          "dddddddd-3333-4444-5555-eeeeeeeeeeee",
          "request",
          "1"
        ],
        [
          "2018-02-01T17:33:15.786Z",
          "|x/Ysh+M1TfU=.c32c265a_",
          null,
          "GET Home/Index",
          "http://fabrikamfiberapp.azurewebsites.net/",
          "True",
          "200",
          "716.2912",
          "500ms-1sec",
          "{\"_MS.ProcessedByMetricExtractors\":\"(Name:'Requests', Ver:'1.0')\"}",
          null,
          "GET Home/Index",
          "x/Ysh+M1TfU=",
          "x/Ysh+M1TfU=",
          "Application Insights Availability Monitoring",
          "eeeeeeee-4444-5555-6666-ffffffffffff",
          "emea-se-sto-edge_eeeeeeee-4444-5555-6666-ffffffffffff",
          null,
          null,
          "AutoGen_49c3aea0-4641-4675-93b5-55f7a62d22d3",
          "PC",
          null,
          null,
          "51.141.32.0",
          "Cardiff",
          "Cardiff",
          "United Kingdom",
          null,
          "fabrikamfiberapp",
          "RD00155D5053D1",
          "bbbbbbbb-1111-2222-3333-cccccccccccc",
          "fabrikamprod",
          "cccccccc-2222-3333-4444-dddddddddddd",
          "web:2.5.0-33031",
          "ffffffff-5555-6666-7777-aaaaaaaaaaaa",
          "request",
          "1"
        ]
      ]
    }
  ]
}

Authorization code flow

The main OAuth2 flow supported is through authorization codes. This method requires two HTTP requests to acquire a token with which to call the Azure Monitor Application Insights API. There are two URLs, with one endpoint per request. The following sections describe their formats.

Authorization code URL (GET request)

The following REST example uses the Microsoft Entra authorization code flow to request an authorization code.

GET https://login.microsoftonline.com/{tenantId}/oauth2/authorize?client_id={clientId}&response_type=code&redirect_uri={redirectUri}&resource=https://api.applicationinsights.io

When you make a request to the authorized URL, the client_id is the application ID from your Microsoft Entra app, copied from the app's properties menu. The redirect_uri is the homepage/login URL from the same Microsoft Entra app. When a request is successful, this endpoint redirects you to the sign-in page you provided at sign-up with the authorization code appended to the URL. See the following example:

http://<RedirectUri>/?code=<AuthorizationCode>&session_state=<SessionState>

At this point, you obtain an authorization code, which you now use to request an access token.

Authorization code token URL (POST request)

The following REST example exchanges the authorization code for a token through the Microsoft Entra authorization code flow.

POST https://login.microsoftonline.com/{tenantId}/oauth2/token HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&client_id=<ClientId>&code=<AuthorizationCode>&redirect_uri=<RedirectUri>&resource=https://api.applicationinsights.io&client_secret=<ClientSecret>

All values are the same as before, with some additions. The authorization code is the same code you received in the previous request after a successful redirect. Combine the code with the key obtained from the Microsoft Entra app. If you didn't save the key, you can delete it and create a new one from the keys tab of the Microsoft Entra app menu. The response is a JSON string that contains the token with the following schema. Types are indicated for the token values.

Response example:

{
  "access_token": "eyJ0eXAiOiJKV1QiLCJ.....Ax",
  "expires_in": "3600",
  "ext_expires_in": "1503641912",
  "id_token": "not_needed_for_app_insights",
  "not_before": "1503638012",
  "refresh_token": "eyJ0esdfiJKV1ljhgYF.....Az",
  "resource": "https://api.applicationinsights.io",
  "scope": "Data.Read",
  "token_type": "bearer"
}

The access token portion of this response is what you present to the Application Insights API in the Authorization: Bearer header. You can also use the refresh token in the future to get a new access_token and refresh_token when yours go stale.

The following REST example uses the Microsoft Entra authorization code flow to refresh a token.

POST https://login.microsoftonline.com/{tenantId}/oauth2/token HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

client_id=<ClientId>&refresh_token=<RefreshToken>&grant_type=refresh_token&resource=https://api.applicationinsights.io&client_secret=<ClientSecret>

Response example:

{
  "token_type": "Bearer",
  "expires_in": "3600",
  "expires_on": "1460404526",
  "resource": "https://api.applicationinsights.io",
  "access_token": "eyJ0eXAiOiJKV1QiLCJ.....Ax",
  "refresh_token": "eyJ0esdfiJKV1ljhgYF.....Az"
}

Implicit code flow

The Application Insights API supports the OAuth2 implicit flow. This flow requires only one request, but it doesn't provide a refresh token.

Implicit code authorization URL

The following REST example requests a token by using the implicit flow.

GET https://login.microsoftonline.com/{tenantId}/oauth2/authorize?client_id={clientId}&response_type=token&redirect_uri={redirectUri}&resource=https://api.applicationinsights.io

A successful request redirects to your redirect URI with the token in the URL:

http://<RedirectUri>/#access_token=<AccessToken>&token_type=Bearer&expires_in=3600&session_state=<SessionState>

This access_token acts as the Authorization: Bearer header value when you send it to the Application Insights API to authorize requests.

Disable local authentication

After you enable Microsoft Entra authentication, you can disable local authentication. When you disable local authentication, you can ingest telemetry authenticated exclusively by Microsoft Entra ID. This configuration affects data access, such as through API keys.

You can disable local authentication by using the Azure portal, Azure Policy, or programmatically.

Azure portal

From your Application Insights resource, select Properties under Configure in the menu on the left. Select Enabled (click to change) if the local authentication is enabled.
Select Disabled and apply your changes.
After disabling local authentication on your resource, you see the corresponding information in the Overview pane.

Azure Policy

Azure Policy for DisableLocalAuth denies users the ability to create a new Application Insights resource without this property set to true. The policy name is Application Insights components should block non-Azure Active Directory based ingestion.

To apply this policy definition to your subscription, create a new policy assignment and assign the policy.

The following example shows the policy template definition:

View the policy that restricts local authentication

{
  "properties": {
    "displayName": "Application Insights components should block non-Azure Active Directory based ingestion",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "description": "Improve Application Insights security by disabling log ingestion that are not AAD-based.",
    "metadata": {
      "version": "1.0.0",
      "category": "Monitoring"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "The effect determines what happens when the policy rule is evaluated to match"
        },
        "allowedValues": [
          "audit",
          "deny",
          "disabled"
        ],
        "defaultValue": "audit"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Insights/components"
          },
          {
            "field": "Microsoft.Insights/components/DisableLocalAuth",
            "notEquals": "true"
          }
        ]
      },
      "then": {
        "effect": "[parameters('effect')]"
      }
    }
  }
}

Programmatic enablement

Use the DisableLocalAuth property to disable local authentication on your Application Insights resource. When you set this property to true, it enforces that Microsoft Entra authentication must be used for all access.

The following templates create a workspace-based Application Insights resource with DisableLocalAuth set to true. The subscriptionId and resourceGroupName parameters identify the linked Log Analytics workspace's subscription and resource group. For the REST API operation, see Components - Create Or Update.

Bicep
ARM template

Note

Template deployments are create-or-update operations, not partial PATCH operations. For an existing resource, include the settings that you need to retain.

The following Bicep example uses the Microsoft.Insights/components resource type. It disables local authentication by setting DisableLocalAuth to true.

param subscriptionId string = '<SubscriptionId>'
param resourceGroupName string = '<ResourceGroupName>'
param resourceName string = '<ResourceName>'
param azureRegion string = '<AzureRegion>'
param workspaceName string = '<WorkspaceName>'
param applicationType string = '<ApplicationType>'
param applicationKind string = '<ApplicationKind>'
param tags object = {}
param disableLocalAuth bool = true

var workspaceResourceId = resourceId(
  subscriptionId,
  resourceGroupName,
  'Microsoft.OperationalInsights/workspaces',
  workspaceName
)

resource applicationInsightsComponent 'Microsoft.Insights/components@<ApiVersion>' = {
  name: resourceName
  location: azureRegion
  kind: applicationKind
  tags: tags
  properties: {
    Application_Type: applicationType
    Flow_Type: 'Bluefield'
    Request_Source: 'rest'
    WorkspaceResourceId: workspaceResourceId
    DisableLocalAuth: disableLocalAuth
  }
}

Note

Template deployments are create-or-update operations, not partial PATCH operations. For an existing resource, include the settings that you need to retain.

The following ARM template example uses the Microsoft.Insights/components resource type. It disables local authentication by setting DisableLocalAuth to true.

Create an Application Insights resource with local authentication disabled

{
  "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "subscriptionId": {
      "type": "string",
      "defaultValue": "<SubscriptionId>"
    },
    "resourceGroupName": {
      "type": "string",
      "defaultValue": "<ResourceGroupName>"
    },
    "resourceName": {
      "type": "string",
      "defaultValue": "<ResourceName>"
    },
    "azureRegion": {
      "type": "string",
      "defaultValue": "<AzureRegion>"
    },
    "workspaceName": {
      "type": "string",
      "defaultValue": "<WorkspaceName>"
    },
    "applicationType": {
      "type": "string",
      "defaultValue": "<ApplicationType>"
    },
    "applicationKind": {
      "type": "string",
      "defaultValue": "<ApplicationKind>"
    },
    "tags": {
      "type": "object",
      "defaultValue": {}
    },
    "disableLocalAuth": {
      "type": "bool",
      "defaultValue": true
    }
  },
  "variables": {
    "workspaceResourceId": "[resourceId(parameters('subscriptionId'), parameters('resourceGroupName'), 'Microsoft.OperationalInsights/workspaces', parameters('workspaceName'))]"
  },
  "resources": [
    {
      "type": "Microsoft.Insights/components",
      "apiVersion": "<ApiVersion>",
      "name": "[parameters('resourceName')]",
      "location": "[parameters('azureRegion')]",
      "kind": "[parameters('applicationKind')]",
      "tags": "[parameters('tags')]",
      "properties": {
        "Application_Type": "[parameters('applicationType')]",
        "Flow_Type": "Bluefield",
        "Request_Source": "rest",
        "WorkspaceResourceId": "[variables('workspaceResourceId')]",
        "DisableLocalAuth": "[parameters('disableLocalAuth')]"
      }
    }
  ]
}

Token audience

When developing a custom client to obtain an access token from Microsoft Entra ID for submitting telemetry to Application Insights, refer to the following table to determine the appropriate audience string for your particular host environment.

Azure cloud version	Token audience value
Azure public cloud	`https://monitor.azure.com`
Microsoft Azure operated by 21Vianet cloud	`https://monitor.azure.cn`
Azure US Government cloud	`https://monitor.azure.us`

If you're using sovereign clouds, you can find the audience information in the connection string as well. The connection string follows this structure:

InstrumentationKey={profile.InstrumentationKey};IngestionEndpoint={ingestionEndpoint};LiveEndpoint={liveDiagnosticsEndpoint};AADAudience={aadAudience}

The audience parameter, AADAudience, can vary depending on your specific environment.

Troubleshooting

For troubleshooting guidance, see Troubleshoot Microsoft Entra authentication issues.

Next steps

Feedback

Was this page helpful?

Last updated on 2026-09-29

Microsoft Entra authentication for Application Insights

Prerequisites

Unsupported scenarios

Configure and enable Microsoft Entra ID-based authentication

Prerequisites

Configuration guidance

Environment variable configuration

Query Application Insights by using Microsoft Entra authentication

Set up authentication

Request an authorization token

Client credentials flow

Client credentials token URL (POST request)

Authorization code flow

Authorization code URL (GET request)

Authorization code token URL (POST request)

Implicit code flow

Implicit code authorization URL

Disable local authentication

Azure portal

Azure Policy

Programmatic enablement

Token audience

Troubleshooting

Next steps

Feedback

Additional resources