Configure Application Insights with managed identity instead of instrumentation key

Question

I have a .NET Framework v4.8.2 application integrated with application insights, utilizing the instrumentation key for directing requests to application insights. Nevertheless, I would like to move this over to Role-Based Access Control (RBAC) as illustrated here: https://learn.microsoft.com/en-us/azure/azure-monitor/app/resources-roles-access-control.

I would like to remove the use of the instrumentation key entirely within the application and instead adopt Azure Managed Identity (DefaultAzureCredential) with permissions using terraform to publish to application insights. Is this possible? if so, how would I go about doing this?

Currently I have an applicatinsightsconfig file with <InstrumentationKey>MyKey</InstrumentationKey> that I would like to remove and replace with managed identity.

Answer 1

A few parts here:

1. Ensure that you're on the latest version of .NET Application Insights SDK (which supports both AAD auth and Connection Strings).
2. Switch to using Connection String (instead of Instrumentation Key) [this is also known as regional ingestion compared to global ingestion (which is deprecated)].
3. Start to use Managed Identity (don't forget to assign "Monitoring Metrics Publisher" role).
4. Validate that ingestion continues to work
5. Disable "Local Auth" (Properties -> LOCAL AUTHENTICATION: Enabled (click to change) -> Switch to Disabled):

Note, Instrumentation Key will continue to be a part of a Connection String but with AAD auth enabled (or more exactly with Local auth disabled) it starts to act only as a resource identifier rather than key.