Granting restricted access to web app logs

Question

I have an ASP.NET Core API that will be hosted on Azure App Services.

I want to expose logs for a specific endpoint to consumers, with access restricted based on a request parameter.

The endpoint uses a custom authorization handler to validate that the user has a claim corresponding to the {name} parameter. Entra ID security groups already exist for each possible value. For example:

POST /endpoint/{name}

At a high level, what is the best approach to expose logs for requests where {name} = x, ensuring that only users who are members of the corresponding security group (e.g., y) can access them?

Answer 1

Hi @ritmo2k

Thanks for outlining your scenario — this is a common requirement when exposing operational data to external consumers, and it’s good you’re thinking about access control early.

At a high level, Azure App Service and Azure Monitor don’t natively support restricting log access based on request parameters (such as {name}) or Entra ID group membership at the log store level. Azure RBAC controls who can access an Application Insights or Log Analytics resource, but once access is granted, users can query all logs in that scope.

Because of this, the recommended and supported approach is to enforce fine‑grained access within your application, rather than exposing logs directly from Azure Monitor.

A common pattern that works well is:

• Ensure that structured logs are sent to Application Insights, incorporating {name} as a custom dimension or property with each request. This approach enables clear filtering of logs by consumer.
• Please ensure that direct access to Application Insights and Log Analytics remains restricted, allowing only internal operators or a managed identity to access these resources.
• Provide access to logs via a custom API endpoint, for example, GET /logs/{name}, and ensure it is secured using Microsoft Entra ID.
• For this endpoint, check the caller’s group membership using your custom authorization handler, and then run a filtered Application Insights or Log Analytics query that returns logs where {name} equals x.

This keeps Azure RBAC responsible for protecting the logging resources themselves, while your API enforces the business rule that “a user can only see logs for the {name} they’re authorized for.” That separation of concerns aligns with Azure security best practices and avoids over‑exposing telemetry.

Reference:

https://learn.microsoft.com/en-us/azure/azure-monitor/app/data-model-complete

https://learn.microsoft.com/en-us/azure/azure-monitor/app/create-workspace-resource?tabs=portal

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/monitor

https://learn.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

If the answer is helpful,  Please do click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you