[BUG] Can't connect to AppInsights with Azure.Monitor.Query with ManagedIdentity.

[vpetit-reimagine]

Library name and version

Azure.Monitor.Query 1.5.0

Describe the bug

Following the example, it is impossible for an Azure Function to actually connect to the AppInsights through the package with

var client = new MetricsQueryClient(new DefaultAzureCredential(options)); // Where options holds the managed identity ID with `ManagedIdentityClientId` property

Expected behavior

The Azure Function should be able to read the Azure AppInsights it is trying to access to.

Actual behavior

Depending on what I am trying to test, I get either:

• DefaultAzureCredential failed to retrieve a token from the included credentials.
• if using new MetricsQueryClient(new ManagedIdentityCredential(id)) I get ManagedIdentityCredential authentication failed: User-assigned managed identity is not supported by the detected managed identity environment. (there is nothing in the documentation explaining what

Reproduction Steps

1. Create an App Service on Azure
2. Create an Application Insights resource on Azure linked to the App Service
3. Create an Azure function (timer or http based) using the Azure.Monitor.Query and Azure.Identity packages, specifying the previous app resource as the one to query (in the form of /subscriptions/{id}/resourceGroups/{rg-name}/providers/microsoft.insights/components/{app-insights-name}).
4. Assign either a system or user-defined managed identity to the Azure Function
5. Run the Azure Function

Environment

No response

[github-actions]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[christothes]

Hi @vpetit-reimagine -
In your repro steps you mention running the Azure Function - are you running it locally or deployed to Azure?

If deployed to Azure, can you get logging of the error while using the ManagedIdentityCredential?

For console output, you would just need to add the following line to your program.

using AzureEventSourceListener listener = AzureEventSourceListener.CreateTraceLogger();

If you need to log the output somewhere other than the console, this can be done as described in these docs.

for example:

using AzureEventSourceListener listener = new AzureEventSourceListener(
    (args, message) => myLogger.Log("[{0:HH:mm:ss:fff}][{1}] {2}", DateTimeOffset.Now, args.Level, message),
    level: EventLevel.Verbose);

[github-actions]

Hi @vpetit-reimagine. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.

[vpetit-reimagine]

Hi @vpetit-reimagine - In your repro steps you mention running the Azure Function - are you running it locally or deployed to Azure?

If deployed to Azure, can you get logging of the error while using the ManagedIdentityCredential?

For console output, you would just need to add the following line to your program.

using AzureEventSourceListener listener = AzureEventSourceListener.CreateTraceLogger();

If you need to log the output somewhere other than the console, this can be done as described in these docs.

for example:

using AzureEventSourceListener listener = new AzureEventSourceListener(
(args, message) => myLogger.Log("[{0:HH:mm:ss:fff}][{1}] {2}", DateTimeOffset.Now, args.Level, message),
level: EventLevel.Verbose);

Hi christothes, I see in the logs on the deployed service that I have a 403 (Forbidden) with AuthorizationFailed error.

If I look more closely, I see the following « The client with object id <client_id> does not have authorization to perform action 'Microsoft.Insights/metrics/read' over scope '/subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.Insights/components/{app-insights-resource}/providers/Microsoft.Insights' or the scope is invalid. If access was recently granted, please refresh your credentials."}}»

I guess this means that some rights were not provided to the credentials. I will investigate further on that end and see if there is anything that was not properly configured.

Do you see anything else I could investigate further just in case my intuition is false?