Azure Monitor data source on Grafana Labs

Configure the Azure Monitor data source

Fri, 03 Apr 2026 19:43:06 +0000

Configure the Azure Monitor data source

This document explains how to configure the Azure Monitor data source and the available configuration options. For general information about data sources, refer to Grafana data sources and Data source management.

Before you begin

Before configuring the Azure Monitor data source, ensure you have the following:

Grafana permissions: You must have the Organization administrator role to configure data sources. Organization administrators can also configure the data source via YAML with the Grafana provisioning system or using Terraform.
Azure prerequisites: Depending on your chosen authentication method, you may need:
- A Microsoft Entra ID (formerly Azure AD) app registration with a service principal (for App Registration authentication)
- A Managed Identity enabled on your Azure VM or App Service (for Managed Identity authentication)
- Workload identity configured in your Kubernetes cluster (for Workload Identity authentication)
- Microsoft Entra ID authentication configured for Grafana login (for Current User authentication)

Note
Grafana Cloud users: Managed Identity and Workload Identity authentication methods are not available in Grafana Cloud because they require Grafana to run on your Azure infrastructure. Use App Registration authentication instead.

Azure RBAC permissions: The identity used to authenticate must have the Reader role on the Azure subscription containing the resources you want to monitor. For Log Analytics queries, the identity also needs appropriate permissions on the Log Analytics workspaces to be queried. Refer to the Azure documentation for role assignments.

Note
The Azure Monitor data source plugin is built into Grafana. No additional installation is required.

Add the data source

To add the Azure Monitor data source:

Click Connections in the left-side menu.
Click Add new connection.
Type Azure Monitor in the search bar.
Select Azure Monitor.
Click Add new data source in the upper right.

You’re taken to the Settings tab where you can configure the data source.

Choose an authentication method

The Azure Monitor data source supports four authentication methods. Choose based on where Grafana is hosted and your security requirements:

Authentication method	Best for	Requirements
App Registration	Any Grafana deployment	Microsoft Entra ID app registration with client secret
Managed Identity	Grafana hosted in Azure (VMs, App Service)	Managed identity enabled on the Azure resource
Workload Identity	Grafana in Kubernetes (AKS)	Workload identity federation configured
Current User	User-level access control	Microsoft Entra ID authentication configured for Grafana login

Configure authentication

Select one of the following authentication methods and complete the configuration.

App Registration

Use a Microsoft Entra ID app registration (service principal) to authenticate. This method works with any Grafana deployment.

App Registration prerequisites

Create an app registration in Microsoft Entra ID. Refer to the Azure documentation for creating a service principal.
Create a client secret for the app registration. Refer to the Azure documentation for creating a client secret.
Assign the Reader role to the app registration on the subscription or resources you want to monitor. Refer to the Azure documentation for role assignments.

App Registration UI configuration

Setting	Description
Authentication	Select App Registration.
Azure Cloud	The Azure environment to connect to. Select Azure for the public cloud, or choose Azure Government or Azure China for national clouds.
Directory (tenant) ID	The GUID that identifies your Microsoft Entra ID tenant.
Application (client) ID	The GUID for the app registration you created.
Client secret	The secret key for the app registration. Keep this secure and rotate periodically.
Default Subscription	Click Load Subscriptions to populate available subscriptions, then select your default.

Provision App Registration with YAML

apiVersion: 1

datasources:
  - name: Azure Monitor
    type: grafana-azure-monitor-datasource
    access: proxy
    jsonData:
      azureAuthType: clientsecret
      cloudName: azuremonitor # See supported cloud names below
      tenantId: <tenant-id>
      clientId: <client-id>
      subscriptionId: <subscription-id> # Optional, default subscription
    secureJsonData:
      clientSecret: <client-secret>
    version: 1

Managed Identity

Use Azure Managed Identity for secure, credential-free authentication when Grafana is hosted in Azure.

Note
Managed Identity is available in Azure Managed Grafana or self-hosted Grafana deployed in Azure. It is not available in Grafana Cloud.

Managed Identity prerequisites

Grafana must be hosted in Azure (App Service, Azure VMs, or Azure Managed Grafana).
Managed identity must be enabled on the Azure resource hosting Grafana.
The managed identity must have the Reader role on the subscription or resources you want to monitor.

For details on Azure managed identities, refer to the Azure documentation.

Managed Identity Grafana server configuration

Enable managed identity in the Grafana server configuration:

[azure]
managed_identity_enabled = true

To use a user-assigned managed identity instead of the system-assigned identity, also set:

[azure]
managed_identity_enabled = true
managed_identity_client_id = <USER_ASSIGNED_IDENTITY_CLIENT_ID>

Refer to Grafana Azure configuration for more details.

Managed Identity UI configuration

Setting	Description
Authentication	Select Managed Identity. The directory ID, application ID, and client secret fields are hidden.
Default Subscription	Click Load Subscriptions to populate available subscriptions, then select your default.

Provision Managed Identity with YAML

apiVersion: 1

datasources:
  - name: Azure Monitor
    type: grafana-azure-monitor-datasource
    access: proxy
    jsonData:
      azureAuthType: msi
      subscriptionId: <subscription-id> # Optional, default subscription
    version: 1

Workload Identity

Use Azure Workload Identity for secure authentication in Kubernetes environments like AKS.

Workload Identity prerequisites

Grafana must be running in a Kubernetes environment with workload identity federation configured.
The workload identity must have the Reader role on the subscription or resources you want to monitor.

For details, refer to the Azure workload identity documentation.

Workload Identity Grafana server configuration

Enable workload identity in the Grafana server configuration:

[azure]
workload_identity_enabled = true

Optional configuration variables:

[azure]
workload_identity_enabled = true
workload_identity_tenant_id = <IDENTITY_TENANT_ID>    # Microsoft Entra ID tenant containing the managed identity
workload_identity_client_id = <IDENTITY_CLIENT_ID>    # Client ID if different from default
workload_identity_token_file = <TOKEN_FILE_PATH>      # Path to the token file

Refer to Grafana Azure configuration and the Azure workload identity documentation for more details.

Workload Identity UI configuration

Setting	Description
Authentication	Select Workload Identity. The directory ID, application ID, and client secret fields are hidden.
Default Subscription	Click Load Subscriptions to populate available subscriptions, then select your default.

Provision Workload Identity with YAML

apiVersion: 1

datasources:
  - name: Azure Monitor
    type: grafana-azure-monitor-datasource
    access: proxy
    jsonData:
      azureAuthType: workloadidentity
      subscriptionId: <subscription-id> # Optional, default subscription
    version: 1

Current User

Forward the logged-in Grafana user’s Azure credentials to the data source for user-level access control.

Warning
Current User authentication is an experimental feature. Engineering and on-call support is not available. Documentation is limited. No SLA is provided. Contact Grafana Support to enable this feature in Grafana Cloud.

Current User prerequisites

Your Grafana instance must be configured with Microsoft Entra ID authentication. Refer to the Microsoft Entra ID authentication documentation.

Configure your Azure App Registration

The App Registration used for Grafana login requires additional configuration:

Enable token issuance:

In the Azure Portal, open your App Registration.
Select Authentication in the side menu.
Under Implicit grant and hybrid flows, check both Access tokens and ID tokens.
Save your changes.

Add API permissions:

In the Azure Portal, open your App Registration.
Select API Permissions in the side menu.
Ensure these permissions are present under Microsoft Graph: openid, profile, email, and offline_access.
Add the following permissions:
- Azure Service Management > Delegated permissions > user_impersonation
- APIs my organization uses > Search for Log Analytics API > Delegated permissions > Data.Read

Refer to the Azure documentation for more information.

Update Grafana scopes:

Update the scopes section in your Grafana Azure authentication configuration to include the .default scope:

.default openid email profile

Current User Grafana server configuration

Enable current user authentication in the Grafana server configuration:

[azure]
user_identity_enabled = true

By default, this also enables fallback service credentials. To disable fallback credentials at the instance level:

[azure]
user_identity_enabled = true
user_identity_fallback_credentials_enabled = false

Note
To use fallback service credentials, the feature toggle idForwarding must be set to true.

Limitations and fallback credentials

Current User authentication doesn’t support backend functionality like alerting, reporting, and recorded queries because user credentials aren’t available for background operations.

To support these features, configure fallback service credentials. When enabled, Grafana uses the fallback credentials for backend operations. Note that operations using fallback credentials are limited to the permissions of those credentials, not the user’s permissions.

Note
Query and resource caching is disabled by default for data sources using Current User authentication.

Current User UI configuration

Setting	Description
Authentication	Select Current User.
Default Subscription	Click Load Subscriptions to populate available subscriptions, then select your default.
Fallback Service Credentials	Enable and configure credentials for backend features like alerting.

Provision Current User with YAML

Note
The oauthPassThru property is required for Current User authentication. The disableGrafanaCache property prevents returning cached responses for resources users don’t have access to.

apiVersion: 1

datasources:
  - name: Azure Monitor
    type: grafana-azure-monitor-datasource
    access: proxy
    jsonData:
      azureAuthType: currentuser
      oauthPassThru: true
      disableGrafanaCache: true
      subscriptionId: <subscription-id> # Optional, default subscription
    version: 1

Additional configuration options

These settings apply to all authentication methods.

General settings

Setting	Description
Name	The data source name used in panels and queries. Example: `azure-monitor-prod`.
Default	Toggle to make this the default data source for new panels.

Enable Basic Logs

Toggle Enable Basic Logs to allow queries against Basic Logs tables in supported Log Analytics Workspaces.

Note
Querying Basic Logs tables incurs additional costs on a per-query basis.

Private data source connect (Grafana Cloud only)

If you’re using Grafana Cloud and need to connect to Azure resources in a private network, use Private Data Source Connect (PDC).

Click the Private data source connect dropdown to select your PDC configuration.
Click Manage private data source connect to view your PDC connection details.

For more information, refer to Private data source connect and Configure PDC.

Supported cloud names

When provisioning the data source, use the following cloudName values:

Azure Cloud	`cloudName` value
Microsoft Azure public cloud	`azuremonitor` (default)
Microsoft Chinese national cloud	`chinaazuremonitor`
US Government cloud	`govazuremonitor`

Note
For Current User authentication, the cloud names differ: use AzureCloud for public cloud, AzureChinaCloud for the Chinese national cloud, and AzureUSGovernment for the US Government cloud.

Verify the connection

After configuring the data source, click Save & test. A successful connection displays a message confirming that the credentials are valid and have access to the configured default subscription.

If the test fails, verify:

Your credentials are correct (tenant ID, client ID, client secret)
The identity has the required Azure RBAC permissions
For Managed Identity or Workload Identity, that the Grafana server configuration is correct
Network connectivity to Azure endpoints

Provision the data source

You can define and configure the Azure Monitor data source in YAML files as part of the Grafana provisioning system. For more information about provisioning, refer to Provisioning Grafana.

Provision quick reference

Authentication method	`azureAuthType` value	Required fields
App Registration	`clientsecret`	`tenantId`, `clientId`, `clientSecret`
Managed Identity	`msi`	None (uses VM identity)
Workload Identity	`workloadidentity`	None (uses pod identity)
Current User	`currentuser`	`oauthPassThru: true`, `disableGrafanaCache: true`

All methods support the optional subscriptionId field to set a default subscription.

For complete YAML examples, see the authentication method sections above.

Configure with Terraform

You can configure the Azure Monitor data source using the Grafana Terraform provider. This approach enables infrastructure-as-code workflows and version control for your Grafana configuration.

Terraform prerequisites

Terraform installed
Grafana Terraform provider configured with appropriate credentials
For Grafana Cloud: A Cloud Access Policy token with data source permissions

Provider configuration

Configure the Grafana provider to connect to your Grafana instance:

terraform {
  required_providers {
    grafana = {
      source  = "grafana/grafana"
      version = ">= 2.0.0"
    }
  }
}

# For Grafana Cloud
provider "grafana" {
  url  = "<YOUR_GRAFANA_CLOUD_STACK_URL>"
  auth = "<YOUR_SERVICE_ACCOUNT_TOKEN>"
}

# For self-hosted Grafana
# provider "grafana" {
#   url  = "http://localhost:3000"
#   auth = "<API_KEY_OR_SERVICE_ACCOUNT_TOKEN>"
# }

Terraform examples

The following examples show how to configure the Azure Monitor data source for each authentication method.

App Registration (client secret):

resource "grafana_data_source" "azure_monitor" {
  type = "grafana-azure-monitor-datasource"
  name = "Azure Monitor"

  json_data_encoded = jsonencode({
    azureAuthType  = "clientsecret"
    cloudName      = "azuremonitor"
    tenantId       = "<TENANT_ID>"
    clientId       = "<CLIENT_ID>"
    subscriptionId = "<SUBSCRIPTION_ID>"
  })

  secure_json_data_encoded = jsonencode({
    clientSecret = "<CLIENT_SECRET>"
  })
}

Managed Identity:

resource "grafana_data_source" "azure_monitor" {
  type = "grafana-azure-monitor-datasource"
  name = "Azure Monitor"

  json_data_encoded = jsonencode({
    azureAuthType  = "msi"
    subscriptionId = "<SUBSCRIPTION_ID>"
  })
}

Workload Identity:

resource "grafana_data_source" "azure_monitor" {
  type = "grafana-azure-monitor-datasource"
  name = "Azure Monitor"

  json_data_encoded = jsonencode({
    azureAuthType  = "workloadidentity"
    subscriptionId = "<SUBSCRIPTION_ID>"
  })
}

Current User:

resource "grafana_data_source" "azure_monitor" {
  type = "grafana-azure-monitor-datasource"
  name = "Azure Monitor"

  json_data_encoded = jsonencode({
    azureAuthType       = "currentuser"
    oauthPassThru       = true
    disableGrafanaCache = true
    subscriptionId      = "<SUBSCRIPTION_ID>"
  })
}

With Basic Logs enabled:

Add enableBasicLogs = true to any of the above configurations:

resource "grafana_data_source" "azure_monitor" {
  type = "grafana-azure-monitor-datasource"
  name = "Azure Monitor"

  json_data_encoded = jsonencode({
    azureAuthType   = "clientsecret"
    cloudName       = "azuremonitor"
    tenantId        = "<TENANT_ID>"
    clientId        = "<CLIENT_ID>"
    subscriptionId  = "<SUBSCRIPTION_ID>"
    enableBasicLogs = true
  })

  secure_json_data_encoded = jsonencode({
    clientSecret = "<CLIENT_SECRET>"
  })
}

For more information about the Grafana Terraform provider, refer to the provider documentation and the grafana_data_source resource.

Azure Monitor query editor

Fri, 03 Apr 2026 19:43:06 +0000

Azure Monitor query editor

Grafana provides a query editor for the Azure Monitor data source, which is located on the Explore page. You can also access the Azure Monitor query editor from a dashboard panel. Click the menu in the upper right of the panel and select Edit.

This document explains querying specific to the Azure Monitor data source. For general documentation on querying data sources in Grafana, refer to Query and transform data.

The Azure Monitor data source can query data from Azure Monitor Metrics and Logs, the Azure Resource Graph, and Application Insights Traces. Each source has its own specialized query editor.

Before you begin

Ensure you have configured the Azure Monitor data source.
Verify your credentials have appropriate permissions for the resources you want to query.

Key concepts

If you’re new to Azure Monitor, here are some key terms used throughout this documentation:

Term	Description
KQL (Kusto Query Language)	The query language used for Azure Monitor Logs and Azure Resource Graph. KQL uses a pipe-based syntax similar to Unix commands and is optimized for read-only data exploration. If you know SQL, the SQL to Kusto cheat sheet can help you get started.
Log Analytics workspace	An Azure resource that collects and stores log data from your Azure resources, applications, and services. You query this data using KQL.
Application Insights	Azure’s application performance monitoring (APM) service. It collects telemetry data like requests, exceptions, and traces from your applications.
Metrics vs. Logs	Metrics are lightweight numeric values collected at regular intervals (e.g., CPU percentage). Logs are detailed records of events with varying schemas (e.g., request logs, error messages). Metrics use a visual query builder; Logs require KQL.

Choose a query editor mode

The Azure Monitor data source’s query editor has four modes depending on which Azure service you want to query:

Metrics for Azure Monitor Metrics
Logs for Azure Monitor Logs
Traces for Application Insights Traces
Azure Resource Graph for Azure Resource Graph

Query Azure Monitor Metrics

Azure Monitor Metrics collects numeric data from supported resources, and you can query them to investigate your resources’ health and usage and maximize availability and performance.

Monitor Metrics use a lightweight format that stores only numeric data in a specific structure and supports near real-time scenarios, making it useful for fast detection of issues. In contrast, Azure Monitor Logs can store a variety of data types, each with their own structure.

Create a Metrics query

To create a Metrics query:

In a Grafana panel, select the Azure Monitor data source.
Select the Metrics service.
Select a resource from which to query metrics by using the subscription, resource group, resource type, and resource fields. Multiple resources can also be selected as long as they belong to the same subscription, region and resource type. Note that only a limited amount of resource types support this feature.
To select a different namespace than the default—for instance, to select resources like storage accounts that are organized under multiple namespaces—use the Namespace option.

Note
Not all metrics returned by the Azure Monitor Metrics API have values.

The data source retrieves lists of supported metrics for each subscription and ignores metrics that never have values.
Select a metric from the Metric field.

Optionally, you can apply further aggregations or filter by dimensions.

Change the aggregation from the default average to show minimum, maximum, or total values.
Specify a custom time grain. By default, Grafana selects a time grain interval for you based on your selected time range.
For metrics with multiple dimensions, you can split and filter the returned metrics. For example, the Application Insights dependency calls metric supports returning multiple time series for successful and unsuccessful calls.

The available options change depending on what is relevant to the selected metric.

You can also augment queries by using template variables.

Format legend aliases

You can change the legend label for Metrics by using aliases. In the Legend Format field, you can combine aliases defined below any way you want.

For example:

Blob Type: {{ blobtype }} becomes Blob Type: PageBlob, Blob Type: BlockBlob
{{ resourcegroup }} - {{ resourcename }} becomes production - web_server

Alias pattern	Description
`{{ subscriptionid }}`	Replaced with the subscription ID.
`{{ subscription }}`	Replaced with the subscription name.
`{{ resourcegroup }}`	Replaced with the resource group.
`{{ namespace }}`	Replaced with the resource type or namespace, such as `Microsoft.Compute/virtualMachines`.
`{{ resourcename }}`	Replaced with the resource name.
`{{ metric }}`	Replaced with the metric name, such as “Percentage CPU”.
`{{ arbitraryDimensionID }}`	Replaced with the value of the specified dimension. For example, `{{ blobtype }}` becomes `BlockBlob`.
`{{ dimensionname }}`	(Legacy for backward compatibility) Replaced with the name of the first dimension.
`{{ dimensionvalue }}`	(Legacy for backward compatibility) Replaced with the value of the first dimension.

Filter with dimensions

Some metrics also have dimensions, which associate additional metadata. Dimensions are represented as key-value pairs assigned to each value of a metric. Grafana can display and filter metrics based on dimension values.

The data source supports the equals, not equals, and starts with operators as detailed in the Monitor Metrics API documentation.

For more information on multi-dimensional metrics, refer to the Azure Monitor data platform metrics documentation and Azure Monitor filtering documentation.

Query Azure Monitor Logs

Azure Monitor Logs collects and organizes log and performance data from supported resources, and makes many sources of data available to query together with the Kusto Query Language (KQL).

While Azure Monitor Metrics stores only simplified numerical data, Logs can store different data types, each with their own structure. You can also perform complex analysis of Logs data by using KQL.

The Azure Monitor data source also supports querying of Basic Logs tables (if they exist in your Log Analytics workspace). This feature must be enabled in the data source configuration.

Logs query builder (public preview)

Note
The Logs query builder is a public preview feature. It may not be enabled in all Grafana environments.

The Logs query builder provides a visual interface for building Azure Monitor Logs queries without writing KQL. This is helpful if you’re new to KQL or want to quickly build simple queries.

To enable the Logs query builder:

Enable the azureMonitorLogsBuilderEditor feature toggle in your Grafana configuration.
Restart Grafana for the change to take effect.

To switch between Builder and Code modes:

When the feature is enabled, a Builder / Code toggle appears in the Logs query editor:

Builder: Use the visual interface to select tables, columns, filters, and aggregations. The builder generates the KQL query for you.
Code: Write KQL queries directly. Use this mode for complex queries that require full KQL capabilities.

New queries default to Builder mode. Existing queries that were created with raw KQL remain in Code mode.

Note
You can switch from Builder to Code mode at any time to view or edit the generated KQL. However, switching from Code to Builder mode may not preserve complex queries that can’t be represented in the builder interface.

Create a Logs query

To create a Logs query:

In a Grafana panel, select the Azure Monitor data source.
Select the Logs service.
Select a resource to query. Multiple resources can be selected as long as they are of the same type.

Alternatively, you can dynamically query all resources under a single resource group or subscription.
Note
If a time span is specified in the query, the overlap between the query time span and the dashboard time range will be used. See the API documentation for details.
Enter your KQL query.

You can also augment queries by using template variables.

To create a Basic Logs query:

Ensure that the data source has the Enable Basic Logs toggle enabled.
In a Grafana panel, select the Azure Monitor data source.
Select the Logs service.
Select a resource to query. Multiple resources can be selected as long as they are of the same type.
Switch the Logs toggle from Analytics to Basic. A modal will display to notify users of potential additional costs.
Note
Basic Logs queries do not support time-ranges specified in the query. The time-range will be hardcoded to the dashboard time-range. There are also other query limitations. See the documentation for details.
Enter your KQL query.

You can also augment queries by using template variables.

Logs query examples

Azure Monitor Logs queries are written using the Kusto Query Language (KQL), a rich language similar to SQL.

The Azure documentation includes resources to help you learn KQL:

Note
Time-range: The time-range used for the query can be modified via the time-range switch:

Selecting Query uses only time-ranges specified within the query.

Selecting Dashboard uses only the Grafana dashboard time-range.

If no time-range is specified in the query, the default Log Analytics time-range applies.

For more details, refer to the Azure Monitor Logs API documentation. If you previously used the Intersection option, it has been migrated to Dashboard.

This example query returns a virtual machine’s CPU performance, averaged over 5-minute time grains:

Perf
// $__timeFilter is a special Grafana macro that filters the results to the time span of the dashboard
| where $__timeFilter(TimeGenerated)
| where CounterName == "% Processor Time"
| summarize avg(CounterValue) by bin(TimeGenerated, 5m), Computer
| order by TimeGenerated asc

Use time series queries for values that change over time, usually for graph visualizations such as the Time series panel. Each query should return at least a datetime column and numeric value column. The result must also be sorted in ascending order by the datetime column.

You can also create a query with at least one non-numeric, non-datetime column. Azure Monitor considers those columns to be dimensions, and they become labels in the response.

For example, this query returns the aggregated count grouped by hour, Computer, and the CounterName:

Perf
| where $__timeFilter(TimeGenerated)
| summarize count() by bin(TimeGenerated, 1h), Computer, CounterName
| order by TimeGenerated asc

You can also select additional number value columns, with or without multiple dimensions. For example, this query returns a count and average value by hour, Computer, CounterName, and InstanceName:

Perf
| where $__timeFilter(TimeGenerated)
| summarize Samples=count(), ["Avg Value"]=avg(CounterValue)
    by bin(TimeGenerated, $__interval), Computer, CounterName, InstanceName
| order by TimeGenerated asc

Use table queries with the Table panel to produce a list of columns and rows. This query returns rows with the six specified columns:

AzureActivity
| where $__timeFilter()
| project TimeGenerated, ResourceGroup, Category, OperationName, ActivityStatus, Caller
| order by TimeGenerated desc

Use macros in Logs queries

To help you write queries, you can use several Grafana macros in the where clause:

Macro	Description
`$__timeFilter()`	Filters the results to the time range of the dashboard. Example: `TimeGenerated >= datetime(2018-06-05T18:09:58.907Z) and TimeGenerated <= datetime(2018-06-05T20:09:58.907Z)`.
`$__timeFilter(datetimeColumn)`	Like `$__timeFilter()`, but specifies a custom field to filter on.
`$__timeFrom()`	Expands to the start of the dashboard time range. Example: `datetime(2018-06-05T18:09:58.907Z)`.
`$__timeTo()`	Expands to the end of the dashboard time range. Example: `datetime(2018-06-05T20:09:58.907Z)`.
`$__escapeMulti($myVar)`	Escapes illegal characters in multi-value template variables. If `$myVar` has the values `'\\grafana-vm\Network(eth0)\Total','\\hello!'` as a string, use this to expand it to `@'\\grafana-vm\Network(eth0)\Total', @'\\hello!'`. If using single-value variables, escape the variable inline instead: `@'\$myVar'`.
`$__contains(colName, $myVar)`	Expands multi-value template variables. If `$myVar` has the value `'value1','value2'`, use this to expand it to `colName in ('value1','value2')`. If using the `All` option, check the `Include All Option` checkbox, and type the value `all` in the `Custom all value` field. If `$myVar` has the value `all`, the macro instead expands to `1 == 1`. For template variables with many options, this avoids building a large “where..in” clause, which improves performance.

Additionally, Grafana has the built-in $__interval macro, which calculates an interval in seconds.

Query Azure Resource Graph

Azure Resource Graph (ARG) is an Azure service designed to extend Azure Resource Management with efficient resource exploration and the ability to query at scale across a set of subscriptions, so that you can more effectively govern an environment. By querying ARG, you can query resources with complex filtering, iteratively explore resources based on governance requirements, and assess the impact of applying policies in a vast cloud environment.

Create a Resource Graph query

ARG queries are written in a variant of the Kusto Query Language (KQL), but not all Kusto language features are available in ARG.

An Azure Resource Graph query is formatted as table data.

If your Azure credentials grant you access to multiple subscriptions, you can choose multiple subscriptions before entering queries. It is also possible to run queries against the directory by changing the scope of the query.

Note
Some queries that function at a directory level may not work at a subscription level and vice-versa.

Resource Graph query examples

The Azure documentation also includes sample queries to help you get started.

Sort results by resource properties:

This query returns all resources in the selected subscriptions, but only the name, type, and location properties:

Resources
| project name, type, location
| order by name asc

This query uses order by to sort the properties by the name property in ascending (asc) order. You can change which property to sort by and the order (asc or desc). This query uses project to show only the listed properties in the results. You can use this to add or remove properties in your queries.

Query resources with complex filtering:

You can filter for Azure resources with a tag name and value.

For example, this query returns a list of resources with an environment tag value of Internal:

Resources
| where tags.environment=~'internal'
| project name

This query uses =~ in the type match to make the query case-insensitive. You can also use project with other properties, or add or remove more.

Group and aggregate the values by property:

You can use summarize and count to define how to group and aggregate values by property.

For example, this query returns counts of healthy, unhealthy, and not applicable resources per recommendation:

securityresources
| where type == 'microsoft.security/assessments'
| extend resourceId=id,
    recommendationId=name,
    resourceType=type,
    recommendationName=properties.displayName,
    source=properties.resourceDetails.Source,
    recommendationState=properties.status.code,
    description=properties.metadata.description,
    assessmentType=properties.metadata.assessmentType,
    remediationDescription=properties.metadata.remediationDescription,
    policyDefinitionId=properties.metadata.policyDefinitionId,
    implementationEffort=properties.metadata.implementationEffort,
    recommendationSeverity=properties.metadata.severity,
    category=properties.metadata.categories,
    userImpact=properties.metadata.userImpact,
    threats=properties.metadata.threats,
    portalLink=properties.links.azurePortal
| summarize numberOfResources=count(resourceId) by tostring(recommendationName), tostring(recommendationState)

In ARG, many nested properties (properties.displayName) are of a dynamic type and should be cast to a string with tostring() in order to operate on them.

Use macros in Resource Graph queries

To help you write queries, you can use several Grafana macros in the where clause:

Macro	Description
`$__timeFilter()`	Expands to `timestamp ≥ datetime(2018-06-05T18:09:58.907Z) and timestamp ≤ datetime(2018-06-05T20:09:58.907Z)`, where the from and to datetimes are from the Grafana time picker.
`$__timeFilter(datetimeColumn)`	Expands to `datetimeColumn ≥ datetime(2018-06-05T18:09:58.907Z) and datetimeColumn ≤ datetime(2018-06-05T20:09:58.907Z)`, where the from and to datetimes are from the Grafana time picker.
`$__timeFrom()`	Returns the From datetime from the Grafana picker. Example: `datetime(2018-06-05T18:09:58.907Z)`.
`$__timeTo()`	Returns the To datetime from the Grafana picker. Example: `datetime(2018-06-05T20:09:58.907Z)`.
`$__escapeMulti($myVar)`	Escapes illegal characters from multi-value template variables. If `$myVar` has the values `'\\grafana-vm\Network(eth0)\Total','\\hello!'` as a string, this expands it to `@'\\grafana-vm\Network(eth0)\Total', @'\\hello!'`. If you use single-value variables, escape the variable inline instead: `@'\$myVar'`.
`$__contains(colName, $myVar)`	Expands multi-value template variables. If `$myVar` has the value `'value1','value2'`, this expands it to `colName in ('value1','value2')`. If using the `All` option, then check the `Include All Option` checkbox and in the `Custom all value` field type in the following value: `all`. If `$myVar` has value `all`, this instead expands to `1 == 1`. For template variables with many options, this avoids building a large “where..in” clause, which improves performance.

Query Application Insights Traces

Azure Application Insights is a service that provides application performance monitoring (APM) features. Application insights can be used to collect metrics, telemetry, and trace logging data.

Application Insights stores trace data in an underlying Log Analytics workspace and traces can be extended to provide additional supporting information as required by the application developer.

Create a Traces query

To create a Traces query:

In a Grafana panel, select the Azure Monitor data source.
Select the Traces service.
Select a resource to query. Multiple resources can be selected as long as they are of the same type.

Note
This query type only supports Application Insights resources.
(Optional) Specify an Operation ID value to filter traces.
(Optional) Specify event types to filter by.
(Optional) Specify event properties to filter by.
(Optional) Change the Result format to switch between tabular format and trace format.

Note
Selecting the trace format filters events to only the trace type. Use this format with the Trace visualization.

Running a query returns all trace data within the time span specified by the panel or dashboard time range.

You can also augment queries by using template variables.

Use queries for alerting and recording rules

All Azure Monitor query types (Metrics, Logs, Azure Resource Graph, and Traces) can be used with Grafana Alerting and recording rules.

For detailed information about creating alert rules, supported query types, authentication requirements, and examples, refer to Azure Monitor alerting.

Work with large Azure resource datasets

If a request exceeds the maximum allowed value of records, the result is paginated and only the first page of results are returned. You can use filters to reduce the amount of records returned under that value.

Next steps

Use template variables to create dynamic, reusable dashboards
Add annotations to overlay events on your graphs
Set up alerting to create alert rules based on Azure Monitor data
Troubleshoot common query and configuration issues

Azure Monitor template variables

Fri, 03 Apr 2026 19:43:06 +0000

Azure Monitor template variables

Instead of hard-coding details such as resource group or resource name values in metric queries, you can use variables. This helps you create more interactive, dynamic, and reusable dashboards. Grafana refers to such variables as template variables.

For an introduction to templating and template variables, refer to the Templating and Add and manage variables.

Before you begin

Ensure you have configured the Azure Monitor data source.
If you want template variables to auto-populate subscriptions, set a Default Subscription in the data source configuration.

Create a template variable

To create a template variable for Azure Monitor:

Open the dashboard where you want to add the variable.
Click Dashboard settings (gear icon) in the top navigation.
Select Variables in the left menu.
Click Add variable.
Enter a Name for your variable (e.g., subscription, resourceGroup, resource).
In the Type dropdown, select Query.
In the Data source dropdown, select your Azure Monitor data source.
In the Query Type dropdown, select the appropriate query type (see Available query types).
Configure any additional fields required by the selected query type.
Click Run query to preview the variable values.
Configure display options such as Multi-value or Include All option as needed.
Click Apply to save the variable.

Available query types

The Azure Monitor data source provides the following query types for template variables:

Query type	Description
Subscriptions	Returns a list of Azure subscriptions accessible to the configured credentials.
Resource Groups	Returns resource groups for a specified subscription. Supports multi-value selection.
Namespaces	Returns metric namespaces for the specified subscription. If a resource group is specified, returns only namespaces within that group.
Regions	Returns Azure regions available for the specified subscription.
Resource Names	Returns resource names for a specified subscription, resource group, and namespace. Supports multi-value selection.
Metric Names	Returns available metric names for a specified resource.
Workspaces	Returns Log Analytics workspaces for the specified subscription.
Logs	Executes a KQL query and returns the results as variable values. See Create a Logs variable.
Custom Namespaces	Returns custom metric namespaces for a specified resource.
Custom Metric Names	Returns custom metric names for a specified resource.

Note
Custom metrics cannot be emitted against a subscription or resource group. Select specific resources when retrieving custom metric namespaces or custom metric names.

Create cascading variables

Cascading variables (also called dependent or chained variables) allow you to create dropdown menus that filter based on previous selections. This is useful for drilling down from subscription to resource group to specific resource.

Example: Subscription → Resource Group → Resource Name

Step 1: Create a Subscription variable

Create a variable named subscription.
Set Query Type to Subscriptions.

Step 2: Create a Resource Group variable

Create a variable named resourceGroup.
Set Query Type to Resource Groups.
In the Subscription field, select $subscription.

Step 3: Create a Resource Name variable

Create a variable named resource.
Set Query Type to Resource Names.
In the Subscription field, select $subscription.
In the Resource Group field, select $resourceGroup.
Select the appropriate Namespace for your resources (e.g., Microsoft.Compute/virtualMachines).

Now when you change the subscription, the resource group dropdown updates automatically, and when you change the resource group, the resource name dropdown updates.

Create a Logs variable

The Logs query type lets you use a KQL query to populate variable values. The query must return a single column of values.

To create a Logs variable:

Create a new variable with Query Type set to Logs.
Select a Resource (Log Analytics workspace or Application Insights resource).
Enter a KQL query that returns a single column.

Logs variable query examples

Query	Returns
`Heartbeat \| distinct Computer`	List of virtual machine names
`Perf \| distinct ObjectName`	List of performance object names
`AzureActivity \| distinct ResourceGroup`	List of resource groups with activity
`AppRequests \| distinct Name`	List of application request names

You can reference other variables in your Logs query:

workspace("$workspace").Heartbeat | distinct Computer

workspace("$workspace").Perf
| where ObjectName == "$object"
| distinct CounterName

Variable refresh options

Control when your variables refresh by setting the Refresh option:

Option	Behavior
On dashboard load	Variables refresh each time the dashboard loads. Best for data that changes infrequently.
On time range change	Variables refresh when the dashboard time range changes. Use for time-sensitive queries.

For dashboards with many variables or complex queries, use On dashboard load to improve performance.

Use variables in queries

After you create template variables, you can use them in your Azure Monitor queries by referencing them with the $ prefix.

Metrics query example

In a Metrics query, select your variables in the resource picker fields:

Subscription: $subscription
Resource Group: $resourceGroup
Resource Name: $resource

Logs query example

Reference variables directly in your KQL queries:

Perf
| where ObjectName == "$object" and CounterName == "$metric"
| where TimeGenerated >= $__timeFrom() and TimeGenerated <= $__timeTo()
| where $__contains(Computer, $computer)
| summarize avg(CounterValue) by bin(TimeGenerated, $__interval), Computer
| order by TimeGenerated asc

Multi-value variables

You can enable Multi-value selection for Resource Groups and Resource Names variables. When using multi-value variables in a Metrics query, all selected resources must:

Belong to the same subscription
Be in the same Azure region
Be of the same resource type (namespace)

Note
When a multi-value variable is used as a parameter in another variable query (for example, to retrieve metric names), only the first selected value is used. Ensure the first resource group and resource name combination is valid.

Troubleshoot template variables

If you encounter issues with template variables, try the following solutions.

Variable returns no values

Verify the Azure Monitor data source is configured correctly and can connect to Azure.
Check that the credentials have appropriate permissions to list the requested resources.
For cascading variables, ensure parent variables have valid selections.

Variable values are outdated

Check the Refresh setting and adjust if needed.
Click the refresh icon next to the variable dropdown to manually refresh.

Multi-value selection not working in queries

Ensure the resources meet the requirements (same subscription, region, and type).
For Logs queries, use the $__contains() macro to handle multi-value variables properly.

Azure Monitor annotations

Fri, 03 Apr 2026 19:43:06 +0000

Azure Monitor annotations

Annotations overlay rich event information on top of graphs. You can use Azure Monitor Log Analytics queries to create annotations that mark important events, deployments, alerts, or other significant occurrences on your dashboards.

Before you begin

Ensure you have configured the Azure Monitor data source.
You need access to a Log Analytics workspace containing the data you want to use for annotations.
Annotations use Log Analytics (KQL) queries only. Metrics, Traces, and Azure Resource Graph queries are not supported for annotations.

Create an annotation query

To add an Azure Monitor annotation to a dashboard:

Open the dashboard where you want to add annotations.
Click Dashboard settings (gear icon) in the top navigation.
Select Annotations in the left menu.
Click Add annotation query.
Enter a Name for the annotation (e.g., “Azure Activity”, “Deployments”).
Select your Azure Monitor data source.
Choose the Logs service.
Select a Resource (Log Analytics workspace or Application Insights resource).
Write a KQL query that returns the annotation data.
Click Apply to save.

Query requirements

Your KQL query should return columns that Grafana can use to create annotations:

Column	Required	Description
`TimeGenerated`	Yes	The timestamp for the annotation. Grafana uses this to position the annotation on the time axis.
`Text`	Recommended	The annotation text displayed when you hover over or click the annotation.
Additional columns	Optional	Any other columns returned become annotation tags.

Note
Always include a time filter in your query to limit results to the dashboard’s time range. Use the $__timeFilter() macro.

Annotation query examples

The following examples demonstrate common annotation use cases.

Azure Activity Log events

Display Azure Activity Log events such as resource modifications, deployments, and administrative actions:

AzureActivity
| where $__timeFilter(TimeGenerated)
| where Level == "Error" or Level == "Warning" or CategoryValue == "Administrative"
| project TimeGenerated, Text=OperationNameValue, Level, ResourceGroup, Caller
| order by TimeGenerated desc
| take 100

Deployment events

Show deployment-related activity:

AzureActivity
| where $__timeFilter(TimeGenerated)
| where OperationNameValue contains "deployments"
| project TimeGenerated, Text=strcat("Deployment: ", OperationNameValue), Status=ActivityStatusValue, ResourceGroup
| order by TimeGenerated desc

Application Insights exceptions

Mark application exceptions as annotations:

AppExceptions
| where $__timeFilter(TimeGenerated)
| project TimeGenerated, Text=strcat(ProblemId, ": ", OuterMessage), SeverityLevel, AppRoleName
| order by TimeGenerated desc
| take 50

Custom events from Application Insights

Display custom events logged by your application:

AppEvents
| where $__timeFilter(TimeGenerated)
| where Name == "DeploymentStarted" or Name == "DeploymentCompleted"
| project TimeGenerated, Text=Name, AppRoleName
| order by TimeGenerated desc

Security alerts

Show security-related alerts:

SecurityAlert
| where $__timeFilter(TimeGenerated)
| project TimeGenerated, Text=AlertName, Severity=AlertSeverity, Description
| order by TimeGenerated desc
| take 50

Resource health events

Display resource health status changes:

AzureActivity
| where $__timeFilter(TimeGenerated)
| where CategoryValue == "ResourceHealth"
| project TimeGenerated, Text=OperationNameValue, Status=ActivityStatusValue, ResourceId
| order by TimeGenerated desc

VM start and stop events

Mark virtual machine state changes:

AzureActivity
| where $__timeFilter(TimeGenerated)
| where OperationNameValue has_any ("start", "deallocate", "restart")
| where ResourceProviderValue == "MICROSOFT.COMPUTE"
| project TimeGenerated, Text=OperationNameValue, VM=Resource, Status=ActivityStatusValue
| order by TimeGenerated desc

Autoscale events

Show autoscale operations:

AzureActivity
| where $__timeFilter(TimeGenerated)
| where OperationNameValue contains "autoscale"
| project TimeGenerated, Text=strcat("Autoscale: ", OperationNameValue), Status=ActivityStatusValue, ResourceGroup
| order by TimeGenerated desc

Customize annotation appearance

After creating an annotation query, you can customize its appearance:

Setting	Description
Color	Choose a color for the annotation markers. Use different colors to distinguish between annotation types.
Show in	Select which panels display the annotations.
Filter by	Add filters to limit when annotations appear.

Best practices

Follow these recommendations when creating annotations:

Limit results: Always use take or limit to restrict the number of annotations. Too many annotations can clutter your dashboard and impact performance.
Use time filters: Include $__timeFilter() to ensure queries only return data within the dashboard’s time range.
Create meaningful text: Use strcat() or project to create descriptive annotation text that provides context at a glance.
Add relevant tags: Include columns like ResourceGroup, Severity, or Status that become clickable tags for filtering.
Use descriptive names: Name your annotations clearly (e.g., “Production Deployments”, “Critical Alerts”) so dashboard users understand what they represent.

Troubleshoot annotations

If annotations aren’t appearing as expected, try the following solutions.

Annotations don’t appear

Verify the query returns data in the selected time range.
Check that the query includes a TimeGenerated column.
Test the query in the Azure Portal Log Analytics query editor.
Ensure the annotation is enabled (toggle is on).

Too many annotations

Add more specific filters to your query.
Use take to limit results.
Narrow the time range.

Annotations appear at wrong times

Verify the TimeGenerated column contains the correct timestamp.
Check your dashboard’s timezone settings.

Azure Monitor alerting

Fri, 03 Apr 2026 19:43:06 +0000

Azure Monitor alerting

The Azure Monitor data source supports Grafana Alerting and Grafana-managed recording rules, allowing you to create alert rules based on Azure metrics, logs, traces, and resource data. You can monitor your Azure environment and receive notifications when specific conditions are met.

Before you begin

Ensure you have the appropriate permissions to create alert rules in Grafana.
Verify your Azure Monitor data source is configured and working correctly.
Familiarize yourself with Grafana Alerting concepts.
Important: Verify your data source uses a supported authentication method. Refer to Authentication requirements.

Supported query types for alerting

All Azure Monitor query types support alerting and recording rules:

Query type	Use case	Notes
Metrics	Threshold-based alerts on Azure resource metrics	Best suited for alerting; returns time-series data
Logs	Alert on log patterns, error counts, or thresholds	Use KQL to aggregate data into numeric values
Azure Resource Graph	Alert on resource state or configuration changes	Use count aggregations to return numeric data
Traces	Alert on trace data and application performance	Use aggregations to return numeric values for evaluation

Note
Alert queries must return numeric data that Grafana can evaluate against a threshold. Queries that return only text or non-numeric data cannot be used directly for alerting.

Authentication requirements

Alerting and recording rules run as background processes without a user context. This means they require service-level authentication and don’t work with all authentication methods.

Authentication method	Supported
App Registration (client secret)	✓
Managed Identity	✓
Workload Identity	✓
Current User	✓ (with fallback service credentials)

Note
If you use Current User authentication, you must configure fallback service credentials for alerting and recording rules to function. User credentials aren’t available for background operations, so Grafana uses the fallback credentials instead. Refer to configure the data source for details on setting up fallback credentials.

Create an alert rule

To create an alert rule using Azure Monitor data:

Go to Alerting > Alert rules.
Click New alert rule.
Enter a name for your alert rule.
In the Define query and alert condition section:
- Select your Azure Monitor data source.
- Configure your query (for example, a Metrics query for CPU usage or a Logs query using KQL).
- Add a Reduce expression if your query returns multiple series.
- Add a Threshold expression to define the alert condition.
Configure the Set evaluation behavior:
- Select or create a folder and evaluation group.
- Set the evaluation interval (how often the alert is checked).
- Set the pending period (how long the condition must be true before firing).
Add labels and annotations to provide context for notifications.
Click Save rule.

For detailed instructions, refer to Create a Grafana-managed alert rule.

Example: VM CPU usage alert

This example creates an alert that fires when virtual machine CPU usage exceeds 80%:

Create a new alert rule.
Configure the query:
- Service: Metrics
- Resource: Select your virtual machine
- Metric namespace: Microsoft.Compute/virtualMachines
- Metric: Percentage CPU
- Aggregation: Average
Add expressions:
- Reduce: Last (to get the most recent data point)
- Threshold: Is above 80
Set evaluation to run every 1 minute with a 5-minute pending period.
Save the rule.

Example: Error log count alert

This example alerts when error logs exceed a threshold using a KQL query:

Create a new alert rule.

Configure the query:

Service: Logs
Resource: Select your Log Analytics workspace

Query:

AppExceptions
| where TimeGenerated > ago(5m)
| summarize ErrorCount = count() by bin(TimeGenerated, 1m)

Add expressions:
- Reduce: Max (to get the highest count in the period)
- Threshold: Is above 10
Set evaluation to run every 5 minutes.
Save the rule.

Example: Resource count alert

This example alerts when the number of running virtual machines drops below a threshold using Azure Resource Graph:

Create a new alert rule.

Configure the query:

Service: Azure Resource Graph
Subscriptions: Select your subscriptions

Query:

resources
| where type == "microsoft.compute/virtualmachines"
| where properties.extended.instanceView.powerState.displayStatus == "VM running"
| summarize RunningVMs = count()

Add expressions:
- Reduce: Last
- Threshold: Is below 3
Set evaluation to run every 5 minutes.
Save the rule.

Best practices

Follow these recommendations to create reliable and efficient alerts with Azure Monitor data.

Use appropriate query intervals

Set the alert evaluation interval to be greater than or equal to the minimum data resolution from Azure Monitor.
Azure Monitor Metrics typically have 1-minute granularity at minimum.
Avoid very short intervals (less than 1 minute) as they may cause evaluation timeouts or miss data points.

Reduce multiple series

When your Azure Monitor query returns multiple time series (for example, CPU usage across multiple VMs), use the Reduce expression to aggregate them:

Last: Use the most recent value
Mean: Average across all series
Max/Min: Use the highest or lowest value
Sum: Total across all series

Optimize Log Analytics queries

For Logs queries used in alerting:

Use summarize to aggregate data into numeric values.
Include appropriate time filters using ago() or TimeGenerated.
Avoid returning large result sets; aggregate data in the query.
Test queries in Explore before using them in alert rules.

Handle no data conditions

Configure what happens when no data is returned:

In the alert rule, find Configure no data and error handling.
Choose an appropriate action:
- No Data: Keep the alert in its current state
- Alerting: Treat no data as an alert condition
- OK: Treat no data as a healthy state

Test queries before alerting

Always verify your query returns expected data before creating an alert:

Go to Explore.
Select your Azure Monitor data source.
Run the query you plan to use for alerting.
Confirm the data format and values are correct.
Verify the query returns numeric data suitable for threshold evaluation.

Troubleshooting

If your Azure Monitor alerts aren’t working as expected, use the following sections to diagnose and resolve common issues.

Alerts not firing

Verify the data source uses a supported authentication method. If using Current User authentication, ensure fallback service credentials are configured.
Check that the query returns numeric data in Explore.
Ensure the evaluation interval allows enough time for data to be available.
Review the alert rule’s health and any error messages in the Alerting UI.

Authentication errors in alert evaluation

If you see authentication errors when alerts evaluate:

Confirm the data source is configured with App Registration, Managed Identity, Workload Identity, or Current User with fallback service credentials.
If using App Registration, verify the client secret hasn’t expired.
If using Current User, verify that fallback service credentials are configured and valid.
Check that the service principal has appropriate permissions on Azure resources.

Query timeout errors

Simplify complex KQL queries.
Reduce the time range in Log Analytics queries.
Add more specific filters to narrow result sets.

For additional troubleshooting help, refer to Troubleshoot Azure Monitor.

Additional resources

Troubleshoot Azure Monitor data source issues

Fri, 03 Apr 2026 19:43:06 +0000

Troubleshoot Azure Monitor data source issues

This document provides solutions to common issues you may encounter when configuring or using the Azure Monitor data source.

Configuration and authentication errors

These errors typically occur when setting up the data source or when authentication credentials are invalid.

“Authorization failed” or “Access denied”

Symptoms:

Save & test fails with “Authorization failed”
Queries return “Access denied” errors
Subscriptions don’t load when clicking Load Subscriptions

Possible causes and solutions:

Cause	Solution
App registration doesn’t have required permissions	Assign the `Reader` role to the app registration on the subscription or resource group you want to monitor. Refer to the Azure documentation for role assignments.
Incorrect tenant ID, client ID, or client secret	Verify the credentials in the Azure Portal under App registrations > your app > Overview (for IDs) and Certificates & secrets (for secret).
Client secret has expired	Create a new client secret in Azure and update the data source configuration.
Managed Identity not enabled on the Azure resource	For VMs, enable managed identity in the Azure Portal under Identity. For App Service, enable it under Identity in the app settings.
Managed Identity not assigned the Reader role	Assign the `Reader` role to the managed identity on the target subscription or resources.

“Invalid client secret” or “Client secret not found”

Symptoms:

Authentication fails immediately after configuration
Error message references invalid credentials

Solutions:

Ensure you copied the client secret value, not the secret ID. In Azure Portal under Certificates & secrets, the secret value is only shown once when created. The secret ID is a different identifier and won’t work for authentication.
Verify the client secret was copied correctly (no extra spaces or truncation).
Check if the secret has expired in Azure Portal under App registrations > your app > Certificates & secrets.
Create a new secret and update the data source configuration.

“Tenant not found” or “Invalid tenant ID”

Symptoms:

Data source test fails with tenant-related errors
Unable to authenticate

Solutions:

Verify the Directory (tenant) ID in Azure Portal under Microsoft Entra ID > Overview.
Ensure you’re using the correct Azure cloud setting (Azure, Azure Government, or Azure China).
Check that the tenant ID is a valid GUID format.

Managed Identity not working

Symptoms:

Managed Identity option is available but authentication fails
Error: “Managed identity authentication is not available”

Solutions:

Verify managed_identity_enabled = true is set in the Grafana server configuration under [azure].
Confirm the Azure resource hosting Grafana has managed identity enabled.
For user-assigned managed identity, ensure managed_identity_client_id is set correctly.
Verify the managed identity has the Reader role on the target resources.
Restart Grafana after changing server configuration.

Workload Identity not working

Symptoms:

Workload Identity authentication fails in Kubernetes/AKS environment
Token file errors

Solutions:

Verify workload_identity_enabled = true is set in the Grafana server configuration.
Check that the service account is correctly annotated for workload identity.
Verify the federated credential is configured in Azure.
Ensure the token path is accessible to the Grafana pod.
Check the workload identity webhook is running in the cluster.

Query errors

These errors occur when executing queries against Azure Monitor services.

“No data” or empty results

Symptoms:

Query executes without error but returns no data
Charts show “No data” message

Possible causes and solutions:

Cause	Solution
Time range doesn’t contain data	Expand the dashboard time range or verify data exists in Azure Portal.
Wrong resource selected	Verify you’ve selected the correct subscription, resource group, and resource.
Metric not available for resource	Not all metrics are available for all resources. Check available metrics in Azure Portal under the resource’s Metrics blade.
Metric has no values	Some metrics only populate under certain conditions (e.g., error counts when errors occur).
Permissions issue	Verify the identity has read access to the specific resource.

“Bad request” or “Invalid query”

Symptoms:

Query fails with 400 error
Error message indicates query syntax issues

Solutions for Logs queries:

Validate your KQL syntax in the Azure Portal Log Analytics query editor.
Check for typos in table names or column names.
Ensure referenced tables exist in the selected workspace.
Verify the time range is valid (not in the future, not too far in the past for data retention).

Solutions for Metrics queries:

Verify the metric name is valid for the selected resource type.
Check that dimension filters use valid dimension names and values.
Ensure the aggregation type is supported for the selected metric.

“Resource not found”

Symptoms:

Query fails with 404 error
Resource picker shows resources that can’t be queried

Solutions:

Verify the resource still exists in Azure (it may have been deleted or moved).
Check that the subscription is correct.
Refresh the resource picker by re-selecting the subscription.
Verify the identity has access to the resource’s resource group.

Logs query timeout

Symptoms:

Query runs for a long time then fails
Error mentions timeout or query limits

Solutions:

Narrow the time range to reduce data volume.
Add filters to reduce the result set.
Use summarize to aggregate data instead of returning raw rows.
Consider using Basic Logs for large datasets (if enabled).
Break complex queries into smaller parts.

“Metrics not available” for a resource

Symptoms:

Resource appears in picker but no metrics are listed
Metric dropdown is empty

Solutions:

Verify the resource type supports Azure Monitor metrics.
Check if the resource is in a region that supports metrics.
Some resources require diagnostic settings to emit metrics—configure these in Azure Portal.
Try selecting a different namespace for the resource.

Azure Resource Graph errors

These errors are specific to Azure Resource Graph (ARG) queries.

“Query execution failed”

Symptoms:

ARG query fails with execution errors
Results don’t match expected resources

Solutions:

Validate query syntax in Azure Portal Resource Graph Explorer.
Check that you have access to the subscriptions being queried.
Verify table names are correct (e.g., Resources, ResourceContainers).
Some ARG features require specific permissions, check ARG documentation.

Query returns incomplete results

Symptoms:

Not all expected resources appear in results
Results seem truncated

Solutions:

ARG queries are paginated. The data source handles pagination automatically, but very large result sets may be limited.
Add filters to reduce result set size.
Verify you have access to all subscriptions containing the resources.

Application Insights Traces errors

These errors are specific to the Traces query type.

“No traces found”

Symptoms:

Trace query returns empty results
Operation ID search finds nothing

Solutions:

Verify the Application Insights resource is collecting trace data.
Check that the time range includes when the traces were generated.
Ensure the Operation ID is correct (copy directly from another trace or log).
Verify the identity has access to the Application Insights resource.

Template variable errors

For detailed troubleshooting of template variables, refer to the template variables troubleshooting section.

Variables return no values

Solutions:

Verify the data source connection is working (test it in the data source settings).
Check that parent variables (for cascading variables) have valid selections.
Verify the identity has permissions to list the requested resources.
For Logs variables, ensure the KQL query returns a single column.

Variables are slow to load

Solutions:

Set variable refresh to On dashboard load instead of On time range change.
Reduce the scope of variable queries (e.g., filter by resource group instead of entire subscription).
For Logs variables, optimize the KQL query to return results faster.

Connection and network errors

These errors indicate problems with network connectivity between Grafana and Azure services.

“Connection refused” or timeout errors

Symptoms:

Data source test fails with network errors
Queries timeout without returning results

Solutions:

Verify network connectivity from Grafana to Azure endpoints.
Check firewall rules allow outbound HTTPS (port 443) to Azure services.
For private networks, ensure Private Link or VPN is configured correctly.
For Grafana Cloud, configure Private Data Source Connect if accessing private resources.

SSL/TLS certificate errors

Symptoms:

Certificate validation failures
SSL handshake errors

Solutions:

Ensure the system time is correct (certificate validation fails with incorrect time).
Verify corporate proxy isn’t intercepting HTTPS traffic.
Check that required CA certificates are installed on the Grafana server.

Get additional help

If you’ve tried the solutions above and still encounter issues:

Check the Grafana community forums for similar issues.
Review the Azure Monitor data source GitHub issues for known bugs.
Enable debug logging in Grafana to capture detailed error information.
Contact Grafana Support if you’re an Enterprise, Cloud Pro or Cloud Contracted user.
When reporting issues, include:
- Grafana version
- Error messages (redact sensitive information)
- Steps to reproduce
- Relevant configuration (redact credentials)