[azure_application_insights] add client secret by jakubgalecki0 · Pull Request #17899 · elastic/integrations

jakubgalecki0 · 2026-03-19T11:36:14Z

Proposed commit message

This pull request adds support for client secret authentication elastic/beats#48880

Tested new auth method
Tested backward compatibility with api_key auth

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

Screenshots

API KEY

github-actions · 2026-03-19T11:38:38Z

✅ Vale Linting Results

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

packages/azure_application_insights/manifest.yml

lucabelluccini · 2026-03-25T13:48:24Z

packages/azure_application_insights/manifest.yml

I think this constraint should be refined to the versions of Beats which include the api key change onwards elastic/beats#48880.

muthu-mps · 2026-03-26T02:07:55Z

packages/azure_application_insights/manifest.yml

 conditions:
  kibana:
-    version: "^8.13.0 || ^9.0.0"
+    version: "^8.19.14 || ^9.2.8"


As we have back-ported to 8.19.0 and 9.2.0. Should we use them instead?
CC: @tommyers-elastic

we should use these constraints:

conditions: kibana: version: "~8.19.14 || ~9.2.8 || ^9.3.3"

for major.minor.patch:

the ~ modifier allows newer patch releases

the ^ modifier also allows new minor releases

muthu-mps · 2026-03-26T02:09:57Z

packages/azure_application_insights/_dev/build/docs/README.md


-`Api Key`:: (_[]string_) The API key which will be generated. See [Azure Monitor Log Analytics API Overview](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/overview) for more information.
+`Authentication Type`:: (_string_) Optional. The authentication method to use. Accepted values: `api_key` or `client_secret`. Defaults to `api_key` if not set.
+


Can we add a note in the README highlighting that users currently authenticating via API Key should migrate to Client Secret?

lucabelluccini · 2026-03-26T15:02:23Z

packages/azure_application_insights/_dev/build/docs/README.md


-`Api Key`:: (_[]string_) The API key which will be generated. See [Azure Monitor Log Analytics API Overview](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/overview) for more information.
+`Authentication Type`:: (_string_) Optional. The authentication method to use. Accepted values: `api_key` or `client_secret`. Defaults to `api_key` if not set.
+


lucabelluccini · 2026-03-26T15:05:56Z

packages/azure_application_insights/manifest.yml

 conditions:
  kibana:
-    version: "^8.13.0 || ^9.0.0"
+    version: "^8.19.0 || ^9.2.0"


This would be actually:

= 8.19.31

= 9.2.8

= 9.3.3

Except if we add a comment on the authentication method that selecting Authentication Type is allowed only on 8.19.31, 9.2.8, 9.3.3 onwards

zmoog · 2026-03-26T15:08:30Z

packages/azure_application_insights/manifest.yml

 conditions:
  kibana:
-    version: "^8.13.0 || ^9.0.0"
+    version: "^8.19.0 || ^9.2.0"


We probably need something like this:

conditions: kibana: version: "~8.19.14 || ~9.2.8 || ^9.3.3"

lucabelluccini · 2026-03-26T15:09:25Z

packages/azure_application_insights/manifest.yml

 conditions:
  kibana:
-    version: "^8.13.0 || ^9.0.0"
+    version: "^8.19.0 || ^9.2.0"


Except if we add a comment on the authentication method that selecting Authentication Type is allowed only on 8.19.31, 9.2.8, 9.3.3 onwards

lucabelluccini · 2026-03-26T15:09:48Z

packages/azure_application_insights/manifest.yml

+  - name: auth_type
+    type: select
+    title: Authentication Type
+    description: The authentication type to use. Either "api_key" or "client_secret".


Can we put a warning that this setting can be used only on 8.19.14, 9.2.8, 9.3.3 onwards?

kibana.version is only a "proxy" of the recommended version and checks only Kibana.
Maybe it is better to be explicit here.

Suggested change

description: The authentication type to use. Either "api_key" or "client_secret".

description: Only for Elastic Agent 8.19.14, 9.2.8, 9.3.3 or more recent: the authentication type to use. Either "api_key" or "client_secret".

This is a suggestion, not the actual "text" to display.

muthu-mps

LGTM!

zmoog

LGTM overall.

I suggest replacing "Azure AD" with "Entra ID" as MSFT moved away from the old service name.

Also consider default the authentication type to client secret for new installs since we're so close to the EOL for API key support.

zmoog · 2026-03-27T14:39:41Z

packages/azure_application_insights/_dev/build/docs/app_insights.md

 `Application ID`:: (_[]string_) ID of the application. This is Application ID from the API Access settings blade in the Azure portal.

-`Api Key`:: (_[]string_) The API key which will be generated, more on the steps here https://dev.applicationinsights.io/documentation/Authorization/API-key-and-App-ID.
+`Authentication Type`:: (_string_) Optional. The authentication method to use. Accepted values: `api_key` or `client_secret`. Defaults to `api_key` if not set.


nit: should we flip the default auth to client_secret for new installs? Microsoft is discontinuing API key support soon, right?

zmoog · 2026-03-27T14:41:24Z

packages/azure_application_insights/_dev/build/docs/README.md

-`Api Key`:: (_[]string_) The API key which will be generated. See [Azure Monitor Log Analytics API Overview](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/overview) for more information.
+`Authentication Type`:: (_string_) Optional. The authentication method to use. Accepted values: `api_key` or `client_secret`. Defaults to `api_key` if not set.
+
+NOTE: API Key authentication is deprecated. Users currently authenticating via API Key are encouraged to migrate to Client Secret authentication. Client Secret authentication uses Azure Active Directory (Azure AD) and provides more robust security through short-lived tokens.


Is MSFT still actively using the "Azure Active Directory"? I guess they moved to Entra ID naming now.

zmoog · 2026-03-27T14:44:47Z

packages/azure_application_insights/changelog.yml

@@ -1,3 +1,8 @@
+- version: "1.10.0-next"
+  changes:
+    - description: Add support for Azure AD client secret authentication. New optional parameters `auth_type`, `client_id`, `client_secret`, and `tenant_id` have been added. `api_key` is now optional.


As before, i suggest to replace "Azure AD" with Entra ID.

zmoog · 2026-03-27T14:47:26Z

packages/azure_application_insights/manifest.yml

+    description: The client ID for Azure AD authentication.
+    multi: false
+    required: false
+    show_user: true
+  - name: client_secret
+    type: password
+    title: Client Secret
+    description: The client secret for Azure AD authentication.
+    secret: true
+    multi: false
+    required: false
+    show_user: true
+  - name: tenant_id
+    type: text
+    title: Tenant ID
+    description: The tenant ID for Azure AD authentication.
+    multi: false
+    required: false


I suggest replacing Azure AD with Entra ID.

elasticmachine · 2026-03-30T07:52:22Z

💚 Build Succeeded

Buildkite Build
Commit: 2a9e06d

History

💚 Build #40444 succeeded b63f69f
💚 Build #40439 succeeded df6a643
💚 Build #40389 succeeded 886b196
💚 Build #40356 succeeded fff9467
💔 Build #40293 failed f02d2d3
💚 Build #40098 succeeded a03c8c3

elastic-vault-github-plugin-prod · 2026-04-08T05:27:02Z

Package azure_application_insights - 1.10.0 containing this change is available at https://epr.elastic.co/package/azure_application_insights/1.10.0/

jakubgalecki0 added 2 commits March 19, 2026 12:33

[azure_application_insights] add client secret

ee14fd4

add pr link

605bf3d

macroscopeapp bot reviewed Mar 19, 2026

View reviewed changes

packages/azure_application_insights/manifest.yml Show resolved Hide resolved

update agent config

ca00d8d

andrewkroh added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:azure_application_insights Azure Application Insights Metrics Overview labels Mar 19, 2026

jakubgalecki0 added 2 commits March 20, 2026 09:05

Merge branch 'main' into app_insights_client_secret

86942cb

Merge branch 'main' into app_insights_client_secret

a03c8c3

lucabelluccini reviewed Mar 25, 2026

View reviewed changes

jakubgalecki0 marked this pull request as ready for review March 25, 2026 13:57

jakubgalecki0 requested a review from a team as a code owner March 25, 2026 13:57

jakubgalecki0 added 2 commits March 25, 2026 14:57

Merge branch 'main' into app_insights_client_secret

54959c0

bump kibana version

f02d2d3

andrewkroh added the Team:Obs-InfraObs Observability Infrastructure Monitoring team [elastic/obs-infraobs-integrations] label Mar 25, 2026

muthu-mps reviewed Mar 26, 2026

View reviewed changes

jakubgalecki0 added 2 commits March 26, 2026 09:03

update readme and kibana.version

c6b5585

build readme

fff9467

lucabelluccini reviewed Mar 26, 2026

View reviewed changes

zmoog reviewed Mar 26, 2026

View reviewed changes

lucabelluccini reviewed Mar 26, 2026

View reviewed changes

jakubgalecki0 added 2 commits March 26, 2026 16:41

add -next flag

a6dc6c8

update auth_type description

df6a643

jakubgalecki0 force-pushed the app_insights_client_secret branch from 886b196 to df6a643 Compare March 27, 2026 09:48

Merge branch 'main' into app_insights_client_secret

b63f69f

muthu-mps approved these changes Mar 27, 2026

View reviewed changes

zmoog approved these changes Mar 27, 2026

View reviewed changes

jakubgalecki0 added 2 commits March 30, 2026 09:18

update docs

65d5164

Merge branch 'main' into app_insights_client_secret

2a9e06d

jakubgalecki0 merged commit 94d8456 into elastic:main Mar 30, 2026
11 checks passed


		`Api Key`:: (_[]string_) The API key which will be generated. See [Azure Monitor Log Analytics API Overview](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/overview) for more information.
		`Authentication Type`:: (_string_) Optional. The authentication method to use. Accepted values: `api_key` or `client_secret`. Defaults to `api_key` if not set.

	description: The authentication type to use. Either "api_key" or "client_secret".
	description: Only for Elastic Agent 8.19.14, 9.2.8, 9.3.3 or more recent: the authentication type to use. Either "api_key" or "client_secret".

Conversation

jakubgalecki0 commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

API KEY

Uh oh!

github-actions bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Vale Linting Results

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lucabelluccini Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lucabelluccini Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

muthu-mps left a comment

Choose a reason for hiding this comment

Uh oh!

zmoog left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Mar 30, 2026

💚 Build Succeeded

History

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

jakubgalecki0 commented Mar 19, 2026 •

edited

Loading

github-actions bot commented Mar 19, 2026 •

edited

Loading

lucabelluccini Mar 26, 2026 •

edited

Loading

lucabelluccini Mar 26, 2026 •

edited

Loading