🔹 Feature: Microsoft Entra Authentication for Application Insights
🔹 What It Does: Ingest telemetry into Application Insights using Microsoft Entra ID instead of instrumentation keys. Managed identities replace shared secrets, and local authentication can be fully disabled — ensuring only Entra-authenticated telemetry reaches your resource. Critical for alerting, autoscaling, and all operational decisions built on telemetry you trust. 🔐
💡 What Is It Giving You:
✅ No More Instrumentation Keys in Config: Apps authenticate via their managed identity — no rotation, no secret leakage, no connection strings in pipelines, ARM templates, or Git.
✅ Disable Local Auth Entirely: Set DisableLocalAuth = true on your App Insights resource to reject API keys and legacy instrumentation keys. Pure Zero Trust telemetry ingestion.
✅ Built-in Azure Policy Enforcement: Use the built-in policy “Application Insights components should block non-Azure Active Directory based ingestion” to audit or enforce across subscriptions or management groups — no custom policies needed.
✅ Broad SDK Coverage — GA: ASP.NET Core, .NET Classic, Java Agent (stable), Node.js, Python — all support Entra auth via DefaultAzureCredential or ManagedIdentityCredential.
✅ Zero-Code Auto-Instrumentation: For Azure App Service, set APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD (system-assigned) or Authorization=AAD;ClientId={uami-client-id} (user-assigned). Done.
✅ Monitoring Metrics Publisher Role: A single built-in RBAC role grants telemetry ingestion rights at resource, RG, or subscription scope — covers all telemetry types.
✅ Trustworthy Operational Decisions: Alerts, autoscale rules, SLOs, and incident response all run on telemetry that can’t be spoofed by rogue sources.
⚠️ Application Insights JavaScript web SDK does not support Entra auth — browser telemetry requires the classic flow
⚠️ Profiler for .NET and Python auto-instrumentation on App Service have gaps — validate before setting DisableLocalAuth in production.
🌐 https://learn.microsoft.com/en-us/azure/azure-monitor/app/azure-ad-authentication
