Connect Azure Application Insights
Connect Application Insights so Adduce reads the alert rules that fired this week and the exceptions your app throws most often.
Adduce reads the Application Insights alert rules that fired for your app this week, and the exceptions it throws most often, and records both as evidence in this project.
Beta
This connector works, but it has not been proven against a real customer account yet, so Adduce badges it Beta wherever it appears. Tell us at hello@adducehq.com if what you see does not match this page.
Before you begin
- Role: project Editor or Lead. A workspace Admin is a lead on every project.
- In Microsoft Entra ID: permission to register an application and create a client secret for it.
- In Azure: permission to assign a role on the resource group that holds your Application Insights resource.
- To hand: the tenant, client and subscription IDs, the client secret, and the resource group and resource names.
- Time: twenty minutes, most of it in the Azure portal.
What Adduce reads
| Surface | What it becomes |
|---|---|
| Alert rules that fired | Evidence naming the rule, how many times it fired in the last seven days, and its severity |
| Exception groups | Evidence naming the exception type and method, with a sample message and how many occurrences there were in the last day — the hundred most frequent |
Both are pain points. Severity sets how serious an alert rule reads: Sev0 is the worst and Sev4 the mildest. Exception counts are the true totals, not the sampled ones, so an app that samples heavily still reports honest numbers.
Permissions the app registration needs
| Role | Where | Why |
|---|---|---|
| Monitoring Reader | on the resource group | resolve the Application Insights resource, read its fired alerts, and run the query that groups exceptions |
That is the only role. Nothing is written, and no other Azure resource is read.
Steps
In Microsoft Entra ID, open App registrations and register an application for Adduce. Its Overview page carries the Application (client) ID, and Overview on the tenant carries the Directory (tenant) ID.
Under Certificates & secrets, create a client secret and copy the value, not the id. Note its expiry — the source needs a new secret before that date.
On the resource group that holds your Application Insights resource, open Access control (IAM) → Add role assignment and give the app Monitoring Reader.
In Adduce, open the project, choose Sources, then Add source, and choose the Azure Application Insights tile.
On Connection details, name the source and fill in the three IDs, the secret, the resource group, and the Application Insights resource name.
Check the resource group name if the role assignment was made by someone else — the help under the field names the screen it is made on.
Choose Continue. Adduce signs in as the app, resolves the resource, then runs one small query against it, so the credentials, the role assignment and the resource are all proved before anything is saved.
First sync and cadence
There is no backfill. Every sync reads alert rules that fired in the last seven days and exceptions from the last twenty-four hours, and refreshes what it already holds rather than adding to it. Adduce syncs once a day at 03:00 UTC, and Sync now runs one immediately.
Resolving the resource comes first: if the client secret has expired, the whole run fails there and says so. After that the two surfaces are read separately, so one failing does not lose the other.
Disconnect or replace credentials
Delete the source from its page and type its name to confirm. Deleting removes the evidence it produced. When the client secret expires, create a new one, delete the source and add it again; the next sync reads the same windows, so nothing is lost.
If it did not work
Why was access denied?
The app registration exists but has no Monitoring Reader role on the resource group, or the role was assigned on the resource rather than on the group. Assign it on the group and try again.
Why is there no resource with that name?
The resource name and the resource group do not go together, or they sit in a different subscription. All three are on the Application Insights resource's own Overview page in the portal.
Why did it stop working after a few months?
Client secrets expire. Azure does not warn Adduce in advance, so the first sign is a failed sync. Create a new secret, then delete the source and add it again.