Azure AD authentication for Application Insights is not working in Azure Function

[AliJP]

I am getting the below error when I am trying to use Azure AD authentication for Application Insights in my Azure Function.
Microsoft.ApplicationInsights: The provided tokenCredential must inherit Azure.Core.TokenCredential (Parameter 'tokenCredential').
I am getting this error both in my local machine and also in my azure portal as a Functions runtime error.

Investigative information

• Timestamp: 2023-05-04T08:00:00Z
• Function App version: 4
• Function App name: func-tpgcp-mail-dev-eu
• Region: North Europe

Repro steps

Here is the code that I wrote in my Startup.Configure:

var managedIdentityCredential = new ManagedIdentityCredential();
services.Configure<TelemetryConfiguration>(config => config.SetAzureTokenCredential(managedIdentityCredential));
services.AddApplicationInsightsTelemetryWorkerService();

Expected behavior

The function app can use its managed identity to authenticate and sends telemetry data to application insights.

Actual behavior

As I said in the description I am getting an error that says ManagedIdentityCredential is not inherited from the TokenCredential class.

Known workarounds

Nothing came to my mind.

Related information

After some investigation, I realized that ReflectionCredentialEnvelope uses reflection to load the TokenCredential type and then uses the type to check if the passed credential object inherits from that type or not. Then I took a look at the loaded modules in the application on my local machine and saw that the Azure.Core.dll is loaded twice with different versions:

Also here are all packages that I used in my app function:

<ItemGroup>
    <PackageReference Include="Azure.Core" Version="1.31.0" />
    <PackageReference Include="Azure.Identity" Version="1.8.2" />
    <PackageReference Include="Azure.Messaging.ServiceBus" Version="7.13.1" />
    <PackageReference Include="Azure.Storage.Blobs" Version="12.16.0" />
    <PackageReference Include="Microsoft.ApplicationInsights.WorkerService" Version="2.21.0" />
    <PackageReference Include="Microsoft.Azure.Cosmos" Version="3.33.0" />
    <PackageReference Include="Microsoft.Azure.Functions.Extensions" Version="1.1.0" />
    <PackageReference Include="Microsoft.Azure.WebJobs.Extensions.CosmosDB" Version="4.2.0" />
    <PackageReference Include="Microsoft.Azure.WebJobs.Extensions.EventGrid" Version="3.2.1" />
    <PackageReference Include="Microsoft.Azure.WebJobs.Extensions.ServiceBus" Version="5.9.0" />
    <PackageReference Include="Microsoft.Azure.WebJobs.Extensions.Storage" Version="5.1.2" />
    <PackageReference Include="Microsoft.Graph" Version="5.8.0" />
    <PackageReference Include="Microsoft.Identity.Client" Version="4.53.0" />
    <PackageReference Include="Microsoft.NET.Sdk.Functions" Version="4.2.0" />
  </ItemGroup>

[AliJP]

I also found this issue (8861) in this project, but it was closed without a proper resolution.

[RohitRanjanMS]

Hi @AliJP, we are working on enabling AAD/ManagedIdentity with ApplicationInsights. This should be available in the July release.

[jamesyao-msft]

I'm fixing this issue by adding an environment variable "APPLICATIONINSIGHTS_CONNECTION_STRING".

This issue should be a code bug from SDK.

[AliJP]

I'm fixing this issue by adding an environment variable "APPLICATIONINSIGHTS_CONNECTION_STRING".

This issue should be a code bug from SDK.

By adding the "APPLICATIONINSIGHTS_CONNECTION_STRING" environment variable, the codeless monitoring by host will be enabled. Based on the Documentation, codeless monitoring for Azure Functions is not supported for use with Azure AD authenticated.

To enable Application Insights by SDK, I used a different environment variable to pass the Connection String ("ApplicationInsights__ConnectionString"). Here is my startup code:

builder.Services.Configure<TelemetryConfiguration>(config => config.SetAzureTokenCredential(new ManagedIdentityCredential()));
builder.Services.AddApplicationInsightsTelemetryWorkerService(options => options.ConnectionString = builder.GetContext().Configuration.GetValue<string>("ApplicationInsights:ConnectionString"));

[jamesyao-msft]

I'm fixing this issue by adding an environment variable "APPLICATIONINSIGHTS_CONNECTION_STRING".
This issue should be a code bug from SDK.

By adding the "APPLICATIONINSIGHTS_CONNECTION_STRING" environment variable, the codeless monitoring by host will be enabled. Based on the Documentation, codeless monitoring for Azure Functions is not supported for use with Azure AD authenticated.

To enable Application Insights by SDK, I used a different environment variable to pass the Connection String ("ApplicationInsights__ConnectionString"). Here is my startup code:

builder.Services.Configure<TelemetryConfiguration>(config => config.SetAzureTokenCredential(new ManagedIdentityCredential()));
builder.Services.AddApplicationInsightsTelemetryWorkerService(options => options.ConnectionString = builder.GetContext().Configuration.GetValue<string>("ApplicationInsights:ConnectionString"));

You are right, so let's wait for @RohitRanjanMS to implement it for Azure Functions.

[RohitRanjanMS]

Here's the PR to support ManagedIdentity and ClientSecret credential. I will check if we can support DefaultAzureCredential and VisualStudioCredential as well.

[krzysztof-madej]

@RohitRanjanMS Thank you for your work!

I wonder if there is any timeframe within which support for ManagedIdentity will be provided?

[AliJP]

Here's the Azure/azure-webjobs-sdk#2986 to support ManagedIdentity and ClientSecret credential. I will check if we can support DefaultAzureCredential and VisualStudioCredential as well.

It would be greate if we can support authentication to Application Insight in Azure Function like other service via the SDK. (This link)

Then the developer can provide the Authentication Provider to the Azure Function. Then it would be possible to use DefaultAzureCredential, ManagedIdentityCredential or even a ChainedTokenCredential.

[dallmair]

This should be available in the July release.

@RohitRanjanMS: Any updates on this?

[Isayaa]

@RohitRanjanMS any update on this ?

[Sagarthore11]

Hello Team,

Thank you so much for your help.

Can you please help us on it

[kmyellareddy]

Hi Team,

Could you please provide ETA to complete this?
we opened the case: 2309120030002783 for this issue.

[ramchandar16]

Hi Team, I would like to know when Function App SDK is updated to see the logs on Monitoring Blade when its uses Managed Identity Authentication with Application Insights.

Please note, one of our customers keenly looking for this feature and I request you to prioritize at your end and confirm with ETA.

Thanks,
Ram.

[gataricd]

Hi all,
is there any update on this? When is it going to be implemented?

[a99cl208]

Hi all,
Any news on this topic?

[RohitRanjanMS]

Please expect this to be available around 3rd week of Jan

[RohitRanjanMS]

#9758
This is expected to go out with the host version 4.30 4.31 release.

[GABRIELNGBTUC]

@RohitRanjanMS Do you have any guidance on how to reduce or disable the logging of the token retrieval calls when this feature is enabled?

Some of our function hosts have finally been updated to the latest version but now our app insights live telemetry is flooded by these calls

The above screenshot is for a single function and we have dozens of them linked to a single app insights and these calls keep being made even when most of the functions are just idling. This makes looking at live tracing hard when filtering to a single app and impossible when following logs from multiple functions.

[RohitRanjanMS]

@GABRIELNGBTUC is it possible for you to share a simple repro?

[GABRIELNGBTUC]

After more testing trying to create a reproduction repo, it appears that the issue may come from the AAD authentication for secure channels to the live metrics.

This authentication methods was also implemented around the time our functions host runtime were upgraded by Azure so it would be a more plausible reason since there is a snippet in the docs about that kind of logs being spammed.

What is strange now is that if I create a new function and configure it the exact same way, none of those logs are reproduced. If I manage to reproduce I'll update you if it comes from the azure function host or create an issue in the corresponding app insights repo if it comes from the QuickPulse AAD authentication.

EDIT: I found an issue with the exact same logs so the issue indeed comes from the application insights SDK microsoft/ApplicationInsights-dotnet#2539

[RohitRanjanMS]

Please follow the documentation here to enable Entra Authentication.

[Sagarthore11]

Thank you so much @RohitRanjanMS