Using Managed Identity with Azure Application Insights

A Managed Identity in Azure allows your app (such as an App Service or Function App) to authenticate securely to other Azure resources without storing credentials or secrets. It’s a built-in Azure feature that gives your app an identity in Microsoft Entra ID (formerly Azure AD).

Step 1 – Enable Managed Identity on Your App

1. Go to your App Service or Function App in the Azure Portal.
2. In the left menu, under Settings, select Identity.
3. Under System assigned, switch the status to On.
4. Click Save.

✅ Your app now has a managed identity registered in Microsoft Entra ID.

Step 2 – Find Your Application Insights Resource

1. In the Azure Portal search bar, type Application Insights.
2. Open your Application Insights instance.
3. In the Overview pane, copy the Resource ID – you’ll need it later.

/subscriptions/<subscription-id>/resourceGroups/<rg-name>/providers/microsoft.insights/components/<appinsights-name>

Step 3 – Grant Role Access (IAM)

1. In your Application Insights blade, go to Access Control (IAM).
2. Click + Add → Add role assignment.
3. Select the role Monitoring Metrics Publisher (allows sending telemetry). Optionally add Monitoring Reader if needed.
4. Click Next, then under Members choose Managed identity.
5. Click + Select members and choose your App Service or Function App.
6. Click Select, then Review + assign.

✅ Your app’s managed identity can now publish telemetry to Application Insights securely.

Step 4 – Verify Connection in Application Insights

1. Run your app to generate telemetry.
2. In the Application Insights resource, open Transaction Search or Live Metrics Stream.
3. You should start to see incoming telemetry data (requests, traces, dependencies, etc.).

🎉 You’ve now set up a secure, secret-free integration using Managed Identity.

Summary

Optional: C# Example Using Managed Identity

using Azure.Identity;
using Microsoft.Extensions.Azure;
using OpenTelemetry.Resources;
using OpenTelemetry.Trace;
using Azure.Monitor.OpenTelemetry.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddOpenTelemetry()
    .WithTracing(tracerBuilder =>
    {
        tracerBuilder
            .SetResourceBuilder(ResourceBuilder.CreateDefault().AddService("MyManagedApp"))
            .AddAspNetCoreInstrumentation()
            .AddHttpClientInstrumentation()
            .AddAzureMonitorTraceExporter(options =>
            {
                options.Credential = new DefaultAzureCredential();
                options.ConnectionString = "MonitorResourceId=<YOUR-APP-INSIGHTS-RESOURCE-ID>";
            });
    });

var app = builder.Build();
app.MapGet("/", () => "Hello from Managed Identity App");
app.Run();

This example uses DefaultAzureCredential which automatically uses the Managed Identity when running in Azure. You no longer need to store an instrumentation key or connection string.