Function App/App Service diagnostic settings to export metrics to event hub does not support using Managed Identity?

Question

What I want to do: I have an Azure Function App for which I want to export my metrics to an Event Hub namespace. The idea is to ingest into an Azure Data Explorer database from the Event Hub. I am required by policy to not use secrets, so my Event Hub has had local authentication disabled, ergo the shared access signature is not a valid way to access it.

Problem: There is seemingly no way to authenticate using managed identity for this scenario. The web UI allows creating a diagnostic setting on the Function App, but only by specifying the event hub name and the policy:

The same is true for creating the diagnostic setting via az cli, the PowerShell module Az.Monitor, and the ARM templates:

• https://learn.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az-monitor-diagnostic-settings-create
• https://learn.microsoft.com/en-us/powershell/module/az.monitor/new-azdiagnosticsetting?view=azps-16.1.0#parameters
• https://learn.microsoft.com/en-us/azure/templates/microsoft.insights/diagnosticsettings?pivots=deployment-language-arm-template#diagnosticsettings-1

Since auth rules on an Event Hub is inherently a key-based access format, is there actually any way to create a managed identity-based secretless setup for this?

I found this previous question, in which a person presented what I can only assume to be an AI hallucinated answer, sicne it refers to demonstrably non-existent parameters and options.

Answer 1

I have found a resolution to my concerns. While it is true that the creation of a diagnostic setting requires specifying an authorization rule from the Event Hub resource, the actual data ingestion does not require its usage.

It appears that data is being ingested with the use of a first-party Azure identity, which uses Entra-based authentication rather than using the shared access signature required by the authorization rule. As best I can tell, the auth rule is really only used to create a link between the two. I have had local auth disabled on my event hub, and I see events being published in my namespace from the metrics export.

One of the pitfalls of this is that your event hub can be network-isolated (as is best practice), so your chosen networking setup needs to allow the first-party Azure.Monitor app in one way or another. When using virtual network allow-listing you should enable the exception "Allow trusted Microsoft services to access this resource". When using network security perimeter for you event hub, your NSP rules should allow the service tag "AzureMonitor" or potentially "AzureMonitorExportMetrics".

Answer 2

Hi,

Diagnostics settings does not support sending data to Event Hub via managed identity and requires policy. Note that Azure Monitor recently announced support for platform metrics via Data Collection Rules. With data collection rules sending platform metrics to Event Hub requires Managed identity so that problem is solved with it. Data collection rules does not support Event Hub policy, only identity. Platform metrics via DCRs is considered the next modern way to forward metrics from Azure resources to other destinations. Unfortunately Function App/App Service is currently not one of the supported resource. I am sure at some point it will be supported but I do not have exact timeline. My suggestion is to reach to your Microsoft representative so your request DCR platform metrics to support Function App/App Service reaches Azure Monitor team and hopefully that resource to be prioritized.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.