How to use Microsoft Azure Application Insights Spoke

Question

How to use Microsoft Azure Application Insights Spoke

Obulareddy, Charith Kumar Reddy 0

i am getting error while testing the spoke
(The provided credentials have insufficient access to perform the requested operation)
i have given all required inputs with correct connection and credentials but still getting the error

Ajay Rathod 175 Reputation points Microsoft External Staff Moderator

2026-07-27T18:05:40.3466667+00:00
Hi @Obulareddy, Charith Kumar Reddy

Greetings for the day, Thanks for reaching out to Q&A.

The "The provided credentials have insufficient access to perform the requested operation" error can be a bit confusing. It doesn't necessarily mean your credentials are incorrect. In most cases, it means your credentials were accepted, but they don't have permission to access the Application Insights resource. That's why your connection details can be correct, but you still see this error.

The two most common reasons are:

Your spoke is still using an Application ID + API Key. Application Insights API keys for querying data were retired on 31 March 2026. If you're still using an API key, authentication will fail even if the values are correct. Instead, use Microsoft Entra ID authentication with a Tenant ID, Client ID, and Client Secret.

Missing permissions on the linked Log Analytics workspace. If you're using a workspace-based Application Insights resource, assigning permissions only on the Application Insights resource is not enough. The same identity also needs access to the linked Log Analytics workspace, where the telemetry data is stored.

What to check

Verify the authentication method

If you're using Application ID + API Key, switch to Microsoft Entra ID authentication.

Register an app in Microsoft Entra ID, grant it the Application Insights API → Data.Read permission, and use the Tenant ID, Client ID, and Client Secret in your spoke configuration.

Check permissions on the Application Insights resource

Go to Application Insights → Access Control (IAM).

Assign the Monitoring Reader (or Reader) role to your app registration.

You can verify the assignment with:

az role assignment list --assignee <objectId> --scope <appInsightsResourceId> -o table

Check permissions on the linked Log Analytics workspace

From the Application Insights resource, open the linked Workspace.

Go to Access Control (IAM) and assign the Log Analytics Reader role to the same app registration.

This is a common step that's often missed.

Test again

If the issue still occurs, wait a few minutes for the role assignments to take effect, then test again.

Compare the new Correlation ID with the previous one to make sure you're seeing a new request rather than a cached error.

One final note: Avoid assigning Contributor or Owner roles just to resolve this issue. These roles allow you to manage the resource, but they don't grant permission to read telemetry data. For data access, use roles such as Monitoring Reader and Log Analytics Reader.

Documents:

https://learn.microsoft.com/en-us/lifecycle/end-of-support/end-of-support-2026#additional-azure-changes

https://learn.microsoft.com/en-us/azure/azure-monitor/app/codeless-overview

https://learn.microsoft.com/en-us/azure/azure-monitor/app/azure-ad-authentication?tabs=aspnetcore#query-application-insights-by-using-microsoft-entra-authentication

https://learn.microsoft.com/en-us/azure/app-service/monitor-app-service?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider&tabs=aspnetcore#insights

1 answer

Your answer

Answer 1

The error means the connection authenticates, but its Microsoft Entra identity probably cannot read the selected Application Insights resource. Microsoft's query guidance requires both Application Insights API permission and Azure role access; valid credentials alone are insufficient.

In the Entra app registration used by the spoke, add Application Insights API Data.Read. On the exact Application Insights resource, open Access control (IAM) and assign Reader to the app's service principal at resource scope. Verify the tenant ID, client ID, secret, and Application Insights App ID all refer to this setup, and ensure the token targets the Application Insights API.

Allow role propagation, refresh or recreate the connection to obtain a new token, and test again. If it still fails, capture the correlation ID and compare the token tenant and audience with the resource. The spoke's field mapping is connector-specific; if Azure permissions are correct, validate those inputs with the connector vendor.

How to use Microsoft Azure Application Insights Spoke

What to check

1 answer

Your answer