Documentation Plugins Azure Monitor Managed Service for Prometheus Configure

Configure the Azure Monitor Managed Service for Prometheus data source

This document explains how to configure the Azure Monitor Managed Service for Prometheus data source and covers Azure authentication, data source settings, and provisioning.

Before you begin

Before you configure the data source, ensure you have:

• Grafana permissions: The organization administrator role to add and configure data sources.
• An Azure Monitor workspace: Including its Prometheus query endpoint URL, which you can copy from the workspace Overview page in the Azure portal.
• Azure credentials: A Microsoft Entra ID identity or Azure managed identity with permission to query the workspace, such as the Monitoring Data Reader role.

Key concepts

If you’re new to Azure Monitor managed service for Prometheus or Azure authentication, these terms are used throughout the configuration:

Add the data source

To add the data source:

1. Click Connections in the left-side menu.
2. Click Add new connection.
3. Type Azure Monitor Managed Service for Prometheus in the search bar.
4. Select Azure Monitor Managed Service for Prometheus.
5. Click Add new data source.

Configure settings

Use the following settings to identify the data source and set its endpoint.

Authentication

The Azure Monitor Managed Service for Prometheus data source authenticates with Microsoft Entra ID. Unlike the core Prometheus data source, Azure authentication is the only authentication method, and Grafana attaches a bearer token to every request to the workspace.

The data source supports four authentication methods. Choose based on where Grafana is hosted, your security requirements, and whether you need alerting:

The Authentication drop-down lists Managed Identity, Workload Identity, and Current User only when the corresponding method is enabled on the Grafana server. If none of those methods are enabled, App Registration is the only option, and its fields appear directly without a drop-down.

Current User authentication doesn’t support background operations such as alerting, reporting, and recorded queries unless you configure fallback service credentials. Alerts then run under the fallback credential’s permissions.

Grafana server prerequisites

The plugin backend attaches Azure tokens only when Azure authentication is enabled on the Grafana server. On self-managed Grafana, add the following setting:

ini Copy

[auth]
azure_auth_enabled = true

If you’ve customized forward_settings_to_plugins under [azure], include grafana-azureprometheus-datasource. Grafana includes this plugin ID by default. A missing entry causes 401 Unauthorized errors even when the data source credentials look correct.

App Registration

Use a Microsoft Entra ID app registration (service principal) with a client secret. This method works with any Grafana deployment, including Grafana Cloud.

To create the app registration and client secret, refer to the Microsoft documentation for creating a service principal. Assign the Monitoring Data Reader role on the Azure Monitor workspace.

Select App Registration in the Authentication drop-down, then complete the following fields:

Managed Identity

Use Azure Managed Identity when Grafana runs in Azure, such as on a virtual machine, App Service, or Azure Managed Grafana. Managed Identity isn’t available in Grafana Cloud.

Enable managed identity in the Grafana server configuration:

ini Copy

[azure]
managed_identity_enabled = true

To use a user-assigned managed identity instead of the system-assigned identity, also set:

ini Copy

[azure]
managed_identity_enabled = true
managed_identity_client_id = <USER_ASSIGNED_IDENTITY_CLIENT_ID>

Grant the identity the Monitoring Data Reader role on the Azure Monitor workspace. In the data source UI, select Managed Identity. The directory ID, application ID, and client secret fields are hidden.

Workload Identity

Use Azure Workload Identity when Grafana runs in Kubernetes with workload identity federation, such as AKS.

Enable workload identity in the Grafana server configuration:

ini Copy

[azure]
workload_identity_enabled = true

Optional overrides:

ini Copy

[azure]
workload_identity_enabled = true
workload_identity_tenant_id = <IDENTITY_TENANT_ID>
workload_identity_client_id = <IDENTITY_CLIENT_ID>
workload_identity_token_file = <TOKEN_FILE_PATH>

Grant the workload identity the Monitoring Data Reader role on the Azure Monitor workspace. In the data source UI, select Workload Identity. For more information, refer to the Azure workload identity documentation.

Current User

Forward the signed-in Grafana user’s Microsoft Entra ID credentials so each user queries with their own permissions.

Enable current user authentication in the Grafana server configuration:

ini Copy

[azure]
user_identity_enabled = true

By default, this also enables fallback service credentials. To disable fallback credentials for the whole instance:

ini Copy

[azure]
user_identity_enabled = true
user_identity_fallback_credentials_enabled = false

Current User authentication doesn’t support backend features such as alerting, reporting, and recorded queries because a user token isn’t available for those requests. To keep those features working, enable Fallback Service Credentials on the data source and provide an App Registration, Managed Identity, or Workload Identity. Features that use the fallback run with that shared identity’s permissions, not the user’s.

Query caching is disabled by default for data sources that use Current User authentication.

Private data source connect

The data source supports Private data source connect (PDC), which lets Grafana Cloud query an Azure Monitor workspace that isn’t exposed to the public internet.

To use PDC with this data source:

1. Set up a PDC connection. Refer to Configure Private data source connect.
2. On the data source configuration page, expand Secure Socks Proxy and select the PDC connection.
3. Click Save & test to verify connectivity through the private network.

Additional settings

Expand Advanced settings to configure optional behavior. These settings are shared with the core Prometheus data source.

Resource-scoped queries

Azure Monitor can scope PromQL queries to a resource, resource group, or subscription instead of an entire workspace. To use this mode:

1. Set Prometheus server URL to the regional query endpoint, https://query.<REGION>.prometheus.monitor.azure.com.
2. In Advanced HTTP settings, add a custom header named x-ms-azure-scoping whose value is the Azure resource ID, resource group ID, or subscription ID.
3. Authenticate with an identity that has at least the Monitoring Reader role on that scope.

For more information, refer to Resource-scoped PromQL queries.

Verify the connection

To verify the connection, click Save & test. When the configuration is valid, Grafana displays a success message such as Successfully queried the Prometheus API. If the test fails, refer to Troubleshooting.

Provision the data source

You can define and configure the data source in code so it’s reproducible across environments. This section covers provisioning with a Grafana YAML file and with Terraform.

The backend reads the client secret from secureJsonData.azureClientSecret. A legacy clientSecret key is accepted only for migrated data sources.

Provision with a YAML file

You can define the data source in YAML files as part of the Grafana provisioning system. For more information, refer to Provisioning Grafana.

The following example provisions the data source with App Registration authentication:

YAML Copy

apiVersion: 1

datasources:
  - name: Azure Monitor Managed Service for Prometheus
    uid: grafana-azureprometheus
    type: grafana-azureprometheus-datasource
    access: proxy
    url: https://<WORKSPACE>.<REGION>.prometheus.monitor.azure.com
    editable: true
    jsonData:
      httpMethod: POST
      defaultEditor: builder
      manageAlerts: true
      azureCredentials:
        authType: clientsecret
        azureCloud: AzureCloud
        clientId: <CLIENT_ID>
        tenantId: <TENANT_ID>
    secureJsonData:
      azureClientSecret: <CLIENT_SECRET>

To use Managed Identity:

YAML Copy

apiVersion: 1

datasources:
  - name: Azure Monitor Managed Service for Prometheus
    type: grafana-azureprometheus-datasource
    access: proxy
    url: https://<WORKSPACE>.<REGION>.prometheus.monitor.azure.com
    jsonData:
      httpMethod: POST
      azureCredentials:
        authType: msi

To use Workload Identity:

YAML Copy

apiVersion: 1

datasources:
  - name: Azure Monitor Managed Service for Prometheus
    type: grafana-azureprometheus-datasource
    access: proxy
    url: https://<WORKSPACE>.<REGION>.prometheus.monitor.azure.com
    jsonData:
      httpMethod: POST
      azureCredentials:
        authType: workloadidentity

To use Current User authentication with App Registration fallback credentials:

YAML Copy

apiVersion: 1

datasources:
  - name: Azure Monitor Managed Service for Prometheus
    type: grafana-azureprometheus-datasource
    access: proxy
    url: https://<WORKSPACE>.<REGION>.prometheus.monitor.azure.com
    jsonData:
      httpMethod: POST
      azureCredentials:
        authType: currentuser
        serviceCredentialsEnabled: true
        serviceCredentials:
          authType: clientsecret
          azureCloud: AzureCloud
          clientId: <CLIENT_ID>
          tenantId: <TENANT_ID>
    secureJsonData:
      azureClientSecret: <CLIENT_SECRET>

Replace the placeholder values:

• <WORKSPACE> and <REGION>: The Azure Monitor workspace name and Azure region from the query endpoint URL.
• <CLIENT_ID> and <TENANT_ID>: The app registration application ID and directory ID.
• <CLIENT_SECRET>: The app registration client secret.

Valid azureCloud values include AzureCloud (public), AzureUSGovernment, and AzureChinaCloud.

Provision with Terraform

You can manage the data source with the Grafana Terraform provider using the grafana_data_source resource. Store secrets such as the client secret in Terraform variables or a secrets manager rather than in plain text.

The following example provisions the data source with App Registration authentication:

hcl Copy

resource "grafana_data_source" "azureprometheus" {
  type = "grafana-azureprometheus-datasource"
  name = "Azure Monitor Managed Service for Prometheus"
  url  = "https://${var.workspace}.${var.region}.prometheus.monitor.azure.com"

  json_data_encoded = jsonencode({
    httpMethod    = "POST"
    defaultEditor = "builder"
    manageAlerts  = true
    azureCredentials = {
      authType   = "clientsecret"
      azureCloud = "AzureCloud"
      clientId   = var.client_id
      tenantId   = var.tenant_id
    }
  })

  secure_json_data_encoded = jsonencode({
    azureClientSecret = var.client_secret
  })
}

To use Managed Identity instead of a client secret:

hcl Copy

resource "grafana_data_source" "azureprometheus" {
  type = "grafana-azureprometheus-datasource"
  name = "Azure Monitor Managed Service for Prometheus"
  url  = "https://${var.workspace}.${var.region}.prometheus.monitor.azure.com"

  json_data_encoded = jsonencode({
    httpMethod = "POST"
    azureCredentials = {
      authType = "msi"
    }
  })
}

To use Workload Identity:

hcl Copy

resource "grafana_data_source" "azureprometheus" {
  type = "grafana-azureprometheus-datasource"
  name = "Azure Monitor Managed Service for Prometheus"
  url  = "https://${var.workspace}.${var.region}.prometheus.monitor.azure.com"

  json_data_encoded = jsonencode({
    httpMethod = "POST"
    azureCredentials = {
      authType = "workloadidentity"
    }
  })
}

To use Current User authentication with App Registration fallback credentials:

hcl Copy

resource "grafana_data_source" "azureprometheus" {
  type = "grafana-azureprometheus-datasource"
  name = "Azure Monitor Managed Service for Prometheus"
  url  = "https://${var.workspace}.${var.region}.prometheus.monitor.azure.com"

  json_data_encoded = jsonencode({
    httpMethod = "POST"
    azureCredentials = {
      authType                  = "currentuser"
      serviceCredentialsEnabled = true
      serviceCredentials = {
        authType   = "clientsecret"
        azureCloud = "AzureCloud"
        clientId   = var.client_id
        tenantId   = var.tenant_id
      }
    }
  })

  secure_json_data_encoded = jsonencode({
    azureClientSecret = var.client_secret
  })
}

Define the referenced variables, for example in a variables.tf file:

hcl Copy

variable "workspace" {
  type = string
}

variable "region" {
  type = string
}

variable "client_id" {
  type = string
}

variable "tenant_id" {
  type = string
}

variable "client_secret" {
  type      = string
  sensitive = true
}