Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,626 questions
How to access Azure Monitor Workspace (Managed Prometheus) metrics from Grafana installed via Helm on AKS?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(204.8, 27%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETP%3C/text%3E%3C/svg%3E)
Thiago Pereira da Silva
40
Reputation points
I'm having trouble integrating Grafana with the new Azure Monitor Workspace.
I have a self-hosted Grafana instance installed via Helm in my AKS cluster. Currently, I use it to query Log Analytics tables like Perf and InsighMetrics to get metrics from my pods.
However, with recent AKS versions, when enabling Azure Monitor Managed Prometheus, metrics are stored in a new Azure Monitor Workspace, and tables like Perf and InsightMetrics are no longer available in the traditional Log Analytics workspace.
I'm fine with this new approach, but the issue is that my Grafana instance running in AKS cannot access the metrics stored in the new Azure Monitor Workspace.
My question is: Is there a way to configure my self-hosted Grafana (not Managed Grafana) to access metrics from the Azure Monitor Workspace with Managed Prometheus? I’d prefer not to rely on Managed Grafana for this.
Note: I know I can revert my monitoring to Log Analytics visualizations (Classic), but I would like to know if there's a way to use data from the Azure Monitor Workspace directly.
Azure Monitor
{count} votes
-
Hazem Ali 0 Reputation points2025-06-04T12:39:15.43+00:00 First, Get the Prometheus endpoint
In Azure Monitor workspace → Overview, copy the “Prometheus query endpoint” URL.
Then, Assign permissions
In the workspace’s IAM, give Grafana’s identity (e.g. an Azure AD–backed “workload identity” in AKS) the Monitoring Metrics Reader role.
Lastly, Configure Grafana data source
- In Grafana → Configuration → Data Sources → Add → Prometheus
- Set URL to the Prometheus endpoint you copied
- Under Auth, choose Azure AD (or Managed/Workload Identity) so Grafana can fetch a token automatically
- Save & Test
Once that’s done,
Grafana can query the managed Prometheus metrics in your Azure Monitor workspace.
-
Thiago Pereira da Silva 40 Reputation points
2025-06-04T12:49:10.45+00:00 In my case, the Azure AD authentication option is not available under the Prometheus data source settings in Grafana. I believe this is because I'm using the open-source version of Grafana installed via Helm, not the Enterprise version. That option might only be available in Grafana Enterprise or Managed Grafana on Azure.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(185.6, 63%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAG%3C/text%3E%3C/svg%3E)
Ashok Gandhi Kotnana 9,545 Reputation points Microsoft External Staff Moderator2025-06-04T14:37:18.47+00:00 Hi @Thiago Pereira da Silva,
when you're running open-source Grafana via Helm in AKS, you won’t see or be able to use options like:
- Azure Authentication” or “Managed Identity” under Prometheus data source
- Azure Monitor plugin with native Azure AD integration
Since you don’t want to use Managed Grafana, here’s a concrete breakdown of what you can do with OSS Grafana:
Option A: Reverse Proxy with Token Injection
Set up a small proxy service that:
- Authenticates to Azure AD using a Managed Identity (via Azure Workload Identity).
- Fetches a token for
[https://monitor.azure.com/.default.]("https://monitor.azure.com/.default%60.") - Forwards requests to the Prometheus endpoint, injecting the
Authorization: Bearer <token>header. - Grafana points to this proxy as if it's just a Prometheus server.
This makes Azure AD token injection transparent to Grafana.
Example Architecture
Grafana (OSS)
↓ Reverse Proxy (e.g., Node.js, nginx + Lua, or oauth2-proxy variant)
↓ Azure Monitor Prometheus Endpoint
You can deploy this proxy in your AKS cluster and use Azure Workload Identity, so it never handles static credentials.
Option B: Remote-Write Metrics to Local Prometheus
Instead of pulling metrics into Grafana:
- Configure Azure Monitor Managed Prometheus to remote_write to your own Prometheus server running in the cluster.
- Grafana connects to that Prometheus instance — all standard, no Azure AD involved.
If the answer is helpful, please do "Upvote it".
-
Ashok Gandhi Kotnana 9,545 Reputation points Microsoft External Staff Moderator
2025-06-06T10:28:44.2833333+00:00 I just wanted to check if the above provided information worked for you or if you need any further assistance?
Please feel free to let us know, as we are always here to help whenever you need us.
Please do not forget to “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.
-
Thiago Pereira da Silva 40 Reputation points
2025-06-06T12:24:30.6533333+00:00 Thank you very much for the detailed suggestions.
However, I was really hoping for something simpler, more straightforward solution, since I'm using Azure cloud services, I expected the integration with Grafana to be a bit more straightforward. Both Option A and Option B seem to introduce a level of complexity and increased cost that I would prefer to avoid for now. Because of that, I haven’t tried them, so I can’t confirm whether they work or not.
For now, I’ll just keep using my self-hosted Grafana with Log Analytics (Classic) while it’s still available.
Appreciate the help!
-
Arko 3,570 Reputation points Microsoft External Staff Moderator2025-06-09T12:02:37.55+00:00 Hello Thiago Pereira da Silva,
When using the open-source version of Grafana installed via Helm in AKS, it is not currently possible to directly connect to the Azure Monitor Workspace (Managed Prometheus) using the Prometheus query endpoint, because Azure Monitor requires Azure Active Directory (Azure AD) token-based authentication, and the OSS Grafana Prometheus data source does not support Azure AD or Managed Identity authentication mechanisms.
The ability to authenticate using Azure Workload Identity or Azure AD tokens is only available in Azure Managed Grafana or Grafana Enterprise, which include official Azure Monitor and Azure authentication plugins. As a result, self-hosted Grafana cannot natively issue the required Bearer token to query the secured Azure Monitor Prometheus endpoint.
To work around this limitation while continuing to use self-hosted Grafana, there are currently only two supported architectural approaches:
- Deploy a reverse proxy that handles Azure AD authentication: You can deploy a small proxy service within your AKS cluster that uses Azure Workload Identity to fetch access tokens for the
https://monitor.azure.com/.defaultscope. This proxy injects theAuthorization: Bearer <token>header into requests and forwards them to the Azure Monitor Workspace Prometheus endpoint. Grafana connects to this proxy as if it were a standard Prometheus instance. This method enables seamless integration but requires maintaining an additional component. - Configure remote_write from Azure Monitor to a local Prometheus instance: Azure Monitor Managed Prometheus supports remote write. You can configure it to forward metrics to a Prometheus server that you deploy and manage inside your AKS cluster. Grafana can then connect to this local Prometheus instance without requiring any Azure-specific authentication. This eliminates the need for token injection but requires operating and scaling your own Prometheus backend.
As of now, there is no simpler or native method to access Azure Monitor Workspace metrics from OSS Grafana, and reverting to Log Analytics remains a temporary alternative. For a fully integrated experience without maintaining workarounds, migrating to Azure Managed Grafana is the recommended approach supported by Microsoft. Thanks.
- Deploy a reverse proxy that handles Azure AD authentication: You can deploy a small proxy service within your AKS cluster that uses Azure Workload Identity to fetch access tokens for the
-
Bheemani Anji Babu 345 Reputation points Microsoft External Staff Moderator2025-06-10T04:11:15.6433333+00:00 Just checking if the provided workaround resolved your issue. If it did, please let us know. If you have any questions or concerns, please respond, and we will take further steps. -Thank you.
-
Bheemani Anji Babu 345 Reputation points Microsoft External Staff Moderator
2025-06-11T04:40:57.68+00:00 We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
-
Thiago Pereira da Silva 40 Reputation points
2025-06-11T12:39:48.0933333+00:00 Hi!
As I previously mentioned, I was hoping for a simpler solution. As this is not currently available, I will continue using Grafana with Log Analytics (Classic) for now. Therefore, I cannot say whether this works or not, as I haven’t tested it.
Thank you for your messages and support. -
Bheemani Anji Babu 345 Reputation points Microsoft External Staff Moderator
2025-06-12T03:51:15.1733333+00:00 Thank you for your update, Since the suggested approach is somehow complex and it will increase the cost efficiency, however you're looking for simple configurations along with less cost optimization but since you're running on classic for now which works just fine. in future if you are getting any blockers with your current environment refer the above provided suggestions or file a new support ticket for guidance, we will be happy to help you out.
-Thank you.
Sign in to comment
Sign in to answer