Azure / Azure/data-api-builder

Support Managed Identity for Application Insights in Data API Builder

Open
#2,742 1 comment 0 reactions 0 assignees View on GitHub
2.x auth cri enhancement triage
Dominant language
C#
Stars
1.5k
Forks
370
Avg merge
3d 17h
Merged PRs (30d)
8

Description

**Description:**

Currently, Data API Builder does not support using **Managed Identity** for authenticating with **Application Insights**, which introduces security concerns for production workloads. Relying solely on connection strings without AAD support can be considered insecure.

### Proposal

Implement support for using **Managed Identity** when configuring Application Insights, following the same pattern used in **Azure Functions**:

#### Example:

Set the `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` environment variable with either:

- `Authorization=AAD` for system-assigned managed identity
- `Authorization=AAD;ClientId=` for user-assigned identity

This pattern is already well-known in the .NET ecosystem and avoids introducing another authentication standard.

### Implementation Suggestions

- Add a new property to the **configuration JSON schema** and **CLI tooling** to support setting the `APPLICATIONINSIGHTS_AUTHENTICATION_STRING`.
- Ensure proper **unit test coverage** for this configuration.
- Update documentation accordingly to reflect the supported authentication modes for Application Insights.

### Why This Matters

- Aligning with established Azure/.NET standards reduces learning curves for developers.
- Avoids fragmentation or confusion caused by introducing new or inconsistent patterns.
- Enables secure, keyless telemetry integration using Entra ID (formerly Azure AD).

### Related Work

There is an existing issue for supporting a **Log Analytics sink** which mentions **Entra ID** support ([#2709](https://github.com/Azure/data-api-builder/issues/2709)), but:
- It appears unrelated to **Application Insights**.
- It uses a different configuration syntax that doesn’t align with Application Insights’ authentication mechanisms.

I'll need to know if this feature would be accepted by the team before I start working on it.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.