You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We have encountered a problem regarding the combination of Durable Tracing V2 and using ManagedIdentity with Application Insights.
We found that when disabling local authentication in our Application Insights (see Microsoft Entra authentication for Application Insights) and relying on the ManagedIdentity of the Azure Function Host to authenticate to Application Insights, we start losing telemetry data related to the V2 distributed tracing.
Looking into the code, it seems like the Durable Function Extension configures its own TelemetryClient which does not take the ManagedIdentity of the Function Host into account.
Expected behavior
When using Managed Identity there should be a way to set the Managed Identity credentials of the Azure Function Hosts when this TelemetryClient is created, similar to how this is handled in the azure-webjobs-sdk with the APPLICATIONINSIGHTS_AUTHENTICATION_STRING (see code here)
Actual behavior
This TelemetryClient only sets the APPINSIGHTS_INSTRUMENTATIONKEY and the APPLICATIONINSIGHTS_CONNECTION_STRING, but does not have a way to set credentials when creating the TelemetryConfiguration (see full code reference here or simplified snippet below)
Relevant source code snippets
privateTelemetryConfigurationSetupTelemetryConfiguration(){TelemetryConfigurationconfig=TelemetryConfiguration.CreateDefault();if(this.OnSend!=null){config.TelemetryChannel=newNoOpTelemetryChannel{OnSend=this.OnSend};}stringresolvedInstrumentationKey=this.nameResolver.Resolve("APPINSIGHTS_INSTRUMENTATIONKEY");stringresolvedConnectionString=this.nameResolver.Resolve("APPLICATIONINSIGHTS_CONNECTION_STRING");boolinstrumentationKeyProvided=!string.IsNullOrEmpty(resolvedInstrumentationKey);boolconnectionStringProvided=!string.IsNullOrEmpty(resolvedConnectionString);if(instrumentationKeyProvided&&connectionStringProvided){this.endToEndTraceHelper.ExtensionWarningEvent(...);}if(!instrumentationKeyProvided&&!connectionStringProvided){this.endToEndTraceHelper.ExtensionWarningEvent(...);}if(instrumentationKeyProvided){this.endToEndTraceHelper.ExtensionInformationalEvent(...);
#pragma warning disable CS0618// Type or member is obsoleteconfig.InstrumentationKey=resolvedInstrumentationKey;
#pragma warning restore CS0618// Type or member is obsolete}if(connectionStringProvided){this.endToEndTraceHelper.ExtensionInformationalEvent(...);config.ConnectionString=resolvedConnectionString;}returnconfig;}
App Details
Durable Functions extension version (e.g. v1.8.3): >=2.4.1
FYI @AnatoliB and @lilyjma, this might be an important issue to prioritize as it is security compliance related, and we may start seeing more asks for this.
I discussed this with @jviau offline and he recommended making the following fix:
Rewrite ITelemetryActivator as an ITelemetryModule so we get TelemetryConfiguration without having to instantiate it ourselves. With this approach, TelemetryConfiguration will have the necessary auth information.
Jacob, feel free to add any details that I missed.
@bachuv, yes it is a very straight forward change of removing our own ITelemetryActivator contract and use ITelemetryModule instead. Register our implementation as a singleton:
Implementation of our module (using existing TelemetryActivator implementation):
Description
We have encountered a problem regarding the combination of Durable Tracing V2 and using ManagedIdentity with Application Insights.
We found that when disabling
local authentication
in our Application Insights (see Microsoft Entra authentication for Application Insights) and relying on the ManagedIdentity of the Azure Function Host to authenticate to Application Insights, we start losing telemetry data related to the V2 distributed tracing.Looking into the code, it seems like the Durable Function Extension configures its own TelemetryClient which does not take the ManagedIdentity of the Function Host into account.
Expected behavior
When using Managed Identity there should be a way to set the Managed Identity credentials of the Azure Function Hosts when this TelemetryClient is created, similar to how this is handled in the
azure-webjobs-sdk
with theAPPLICATIONINSIGHTS_AUTHENTICATION_STRING
(see code here)Actual behavior
This TelemetryClient only sets the
APPINSIGHTS_INSTRUMENTATIONKEY
and theAPPLICATIONINSIGHTS_CONNECTION_STRING
, but does not have a way to set credentials when creating the TelemetryConfiguration (see full code reference here or simplified snippet below)Relevant source code snippets
App Details
tagging: @ransonjb
The text was updated successfully, but these errors were encountered: