This is documentation for the next version of Grafana documentation. For the latest stable release, go to the latest version.

Documentation Grafana documentation Data sources Azure Monitor Configure

Configure the Azure Monitor data source

This document explains how to configure the Azure Monitor data source and the available configuration options. For general information about data sources, refer to Grafana data sources and Data source management.

Before you begin

Before configuring the Azure Monitor data source, ensure you have the following:

• Grafana permissions: You must have the Organization administrator role to configure data sources. Organization administrators can also configure the data source via YAML with the Grafana provisioning system or using Terraform.

• Azure prerequisites: Depending on your chosen authentication method, you may need:

  • A Microsoft Entra ID (formerly Azure AD) app registration with a service principal (for App Registration authentication)
  • A Managed Identity enabled on your Azure VM or App Service (for Managed Identity authentication)
  • Workload identity configured in your Kubernetes cluster (for Workload Identity authentication)
  • Microsoft Entra ID authentication configured for Grafana login (for Current User authentication)

• Azure RBAC permissions: The identity used to authenticate must have the Reader role on the Azure subscription containing the resources you want to monitor. For Log Analytics queries, the identity also needs appropriate permissions on the Log Analytics workspaces to be queried. Refer to the Azure documentation for role assignments.

Add the data source

To add the Azure Monitor data source:

1. Click Connections in the left-side menu.
2. Click Add new connection.
3. Type Azure Monitor in the search bar.
4. Select Azure Monitor.
5. Click Add new data source in the upper right.

You’re taken to the Settings tab where you can configure the data source.

Choose an authentication method

The Azure Monitor data source supports five authentication methods. Choose based on where Grafana is hosted, your security requirements, and whether you need alerting:

Configure authentication

Select one of the following authentication methods and complete the configuration.

App Registration (client secret)

Use a Microsoft Entra ID app registration (service principal) to authenticate. This method works with any Grafana deployment.

App Registration prerequisites

1. Create an app registration in Microsoft Entra ID. Refer to the Azure documentation for creating a service principal.

2. Create a client secret for the app registration. Refer to the Azure documentation for creating a client secret.

3. Assign the Reader role to the app registration on the subscription or resources you want to monitor. Refer to the Azure documentation for role assignments.

App Registration UI configuration

Provision App Registration with YAML

YAML Copy

apiVersion: 1

datasources:
  - name: Azure Monitor
    type: grafana-azure-monitor-datasource
    access: proxy
    jsonData:
      azureAuthType: clientsecret
      cloudName: azuremonitor # See supported cloud names below
      tenantId: <tenant-id>
      clientId: <client-id>
      subscriptionId: <subscription-id> # Optional, default subscription
    secureJsonData:
      clientSecret: <client-secret>
    version: 1

App Registration (client certificate)

Use a Microsoft Entra ID app registration with a certificate.

App Registration (client certificate) prerequisites

1. Create an app registration in Microsoft Entra ID. Refer to the Azure documentation for creating a service principal.
2. Create or retrieve an existing certificate (see examples below for creating self-signed PEM or PFX certificates).
3. Upload a certificate to the app registration in PEM or PFX format. Refer to the Azure documentation here.
4. Assign the Reader role to the app registration on the subscription or resources you want to monitor. Refer to the Azure documentation for role assignments.

Add the certificate to the app registration

Add the public certificate to your app registration in the Azure portal:

1. Open the app registration in Azure.
2. Select Certificates & secrets.
3. Select Certificates.
4. Click Upload certificate.
5. Upload the certificate file that contains the public certificate (.cer, .crt, or .pem).
6. Save your changes.

The uploaded certificate is used by Microsoft Entra ID to validate the client assertion signature from Grafana.

Certificate formats

The Azure Monitor data source supports the following certificate formats:

• PEM: Provide both the certificate and private key in PEM text format.
• PFX: Provide a base64-encoded PFX payload in the Client Certificate field, and provide the certificate password.

Create self-signed certificates

The following examples are for test and lab environments. For production, use certificates from your internal or public certificate authority.

Create a self-signed PEM certificate and private key with OpenSSL:

sh Copy

openssl genrsa -out key.pem 2048
openssl req -new -sha256 -key key.pem -out csr.csr
openssl req -x509 -sha256 -days 365 -key key.pem -in csr.csr -out certificate.pem

In this example:

• certificate.pem is uploaded to Certificates & secrets in Azure.
• certificate.pem is the client certificate added to Grafana.
• key.pem is the private key added to Grafana.

Create an encrypted, base64 encoded PFX certificate:

sh Copy

openssl genrsa -out key.pem 2048
openssl req -new -sha256 -key key.pem -out csr.csr
openssl req -x509 -sha256 -days 365 -key key.pem -in csr.csr -out certificate.pem
openssl pkcs12 -export -inkey key.pem -in certificate.pem -out certificate.pfx
openssl base64 -in certificate.pfx -out certificate.b64

Ensure you make note of the password you use to encrypt the certificate.

In this example:

• certificate.pem is uploaded to Certificates & secrets in Azure.
• certificate.b64 is the encrypted, encoded file added to Grafana (in the client certificate field).

App Registration (client certificate) UI configuration

Provision App Registration (client certificate) with YAML

To provision the Azure Monitor data source with client certificate authentication, use the following configuration:

YAML Copy

apiVersion: 1

datasources:
  - name: Azure Monitor
    type: grafana-azure-monitor-datasource
    access: proxy
    jsonData:
      azureAuthType: clientcertificate
      cloudName: azuremonitor # See supported cloud names below
      tenantId: <tenant-id>
      clientId: <client-id>
      certificateFormat: pem # Use pem or pfx
      subscriptionId: <subscription-id> # Optional, default subscription
    secureJsonData:
      clientCertificate: <certificate-content>
      privateKey: <private-key-content> # pem only
      certificatePassword: <certificate-password> # pfx only, if set
    version: 1

Managed Identity

Use Azure Managed Identity for secure, credential-free authentication when Grafana is hosted in Azure.

Managed Identity prerequisites

• Grafana must be hosted in Azure (App Service, Azure VMs, or Azure Managed Grafana).
• Managed identity must be enabled on the Azure resource hosting Grafana.
• The managed identity must have the Reader role on the subscription or resources you want to monitor.

For details on Azure managed identities, refer to the Azure documentation.

Managed Identity Grafana server configuration

Enable managed identity in the Grafana server configuration:

ini Copy

[azure]
managed_identity_enabled = true

To use a user-assigned managed identity instead of the system-assigned identity, also set:

ini Copy

[azure]
managed_identity_enabled = true
managed_identity_client_id = <USER_ASSIGNED_IDENTITY_CLIENT_ID>

Refer to Grafana Azure configuration for more details.

Managed Identity UI configuration

Provision Managed Identity with YAML

YAML Copy

apiVersion: 1

datasources:
  - name: Azure Monitor
    type: grafana-azure-monitor-datasource
    access: proxy
    jsonData:
      azureAuthType: msi
      subscriptionId: <subscription-id> # Optional, default subscription
    version: 1

Workload Identity

Use Azure Workload Identity for secure authentication in Kubernetes environments like AKS.

Workload Identity prerequisites

• Grafana must be running in a Kubernetes environment with workload identity federation configured.
• The workload identity must have the Reader role on the subscription or resources you want to monitor.

For details, refer to the Azure workload identity documentation.

Workload Identity Grafana server configuration

Enable workload identity in the Grafana server configuration:

ini Copy

[azure]
workload_identity_enabled = true

Optional configuration variables:

ini Copy

[azure]
workload_identity_enabled = true
workload_identity_tenant_id = <IDENTITY_TENANT_ID>    # Microsoft Entra ID tenant containing the managed identity
workload_identity_client_id = <IDENTITY_CLIENT_ID>    # Client ID if different from default
workload_identity_token_file = <TOKEN_FILE_PATH>      # Path to the token file

Refer to Grafana Azure configuration and the Azure workload identity documentation for more details.

Workload Identity UI configuration

Provision Workload Identity with YAML

YAML Copy

apiVersion: 1

datasources:
  - name: Azure Monitor
    type: grafana-azure-monitor-datasource
    access: proxy
    jsonData:
      azureAuthType: workloadidentity
      subscriptionId: <subscription-id> # Optional, default subscription
    version: 1

Current User

Forward the logged-in Grafana user’s Azure credentials to the data source for user-level access control.

Current User prerequisites

Your Grafana instance must be configured with Microsoft Entra ID authentication. Refer to the Microsoft Entra ID authentication documentation.

Configure your Azure App Registration

The App Registration used for Grafana login requires additional configuration:

Enable token issuance:

1. In the Azure Portal, open your App Registration.
2. Select Authentication in the side menu.
3. Under Implicit grant and hybrid flows, check both Access tokens and ID tokens.
4. Save your changes.

Add API permissions:

1. In the Azure Portal, open your App Registration.
2. Select API Permissions in the side menu.
3. Ensure these permissions are present under Microsoft Graph: openid, profile, email, and offline_access.
4. Add the following permissions:
   • Azure Service Management > Delegated permissions > user_impersonation
   • APIs my organization uses > Search for Log Analytics API > Delegated permissions > Data.Read

Refer to the Azure documentation for more information.

Update Grafana scopes:

Update the scopes section in your Grafana Azure authentication configuration to include the .default scope:

Copy

.default openid email profile

Current User Grafana server configuration

Enable current user authentication in the Grafana server configuration:

ini Copy

[azure]
user_identity_enabled = true

By default, this also enables fallback service credentials. To disable fallback credentials at the instance level:

ini Copy

[azure]
user_identity_enabled = true
user_identity_fallback_credentials_enabled = false

Limitations and fallback credentials

Current User authentication doesn’t support backend functionality like alerting, reporting, and recorded queries because user credentials aren’t available for background operations.

To support these features, you must configure fallback service credentials, typically an App Registration with client secret. When enabled, Grafana uses the fallback credentials for backend operations. Operations using fallback credentials are limited to the permissions of those credentials, not the user’s permissions.

Current User UI configuration