Legacy authentication for Container Insights

Container Insights defaults to managed identity authentication, which has a monitoring agent that uses the cluster's managed identity to send data to Azure Monitor. It replaced the legacy certificate-based local authentication and removed the requirement of adding a Monitoring Metrics Publisher role to the cluster.

This article describes how to migrate to managed identity authentication if you enabled Container insights using legacy authentication method, and also how to enable legacy authentication if you have that requirement.

Find clusters using Legacy authentication

The following queries list the clusters using legacy authentication in Container Insights. To run the queries, use the Resource Graph Explorer. The query runs in the existing Azure portal scope. For more information on how to set scope and run Azure Resource Graph queries in the portal, see Quickstart: Run Resource Graph query using Azure portal.

Query for AKS clusters

resources        
| where type =~ 'Microsoft.ContainerService/managedClusters'       
| project id, name, aksproperties = parse_json(tolower(properties)), location, identity        
| extend isEnabled = aksproperties.addonprofiles.omsagent.enabled         
| extend workspaceResourceId = iif(isEnabled == true, aksproperties.addonprofiles.omsagent.config.loganalyticsworkspaceresourceid, '')        
| extend useAADAuth  = aksproperties.addonprofiles.omsagent.config.useaadauth  
| where isEnabled =~ "true" and useAADAuth != true 
| extend parts = split(tostring(id), "/")
| extend subscriptionId = parts[2], AKSClusterName = parts[-1], resourceGroupName = parts[4] 
| project AKSClusterName, resourceGroupName, subscriptionId, location, AKSClusterId = tolower(id), workspaceResourceId 

Query for on-prem clusters i.e. clusters using Arc.

KubernetesConfigurationResources          
| where type =~ "Microsoft.KubernetesConfiguration/extensions"           
| extend properties = parse_json(tolower(properties))           
| extend extensionType = properties.extensiontype            
| where extensionType in~ ('microsoft.azuremonitor.containers')           
| extend omsagentUseAADAuth = tostring(properties.configurationsettings.["omsagent.useaadauth"])           
| extend amalogsUseAADAuth = tostring(properties.configurationsettings.["amalogs.useaadauth"])            
| extend useAADAuth = iff(omsagentUseAADAuth == 'true' or amalogsUseAADAuth == 'true', 'true', 'false')            
| extend workspaceResourceId = tostring(properties.configurationsettings.loganalyticsworkspaceresourceid)            
| extend resourceId = tolower(split(id, "/providers/Microsoft.KubernetesConfiguration")[0]) 
| where useAADAuth != "true"
| extend parts = split(tostring(resourceId), "/")
| extend subscriptionId = parts[2], ClusterName = parts[-1], ResourceGroupName = parts[4] 
| project ClusterName, ResourceGroupName,resourceId, subscriptionId, workspaceResourceId

Migrate to managed identity authentication

If you enabled Container insights before managed identity authentication was available, you can use the following methods to migrate your clusters. Managed identity authentication is more secure and performant. It gives you access to newer Azure Monitor Container Insights features, such as syslog collection and high scale logs mode.

What happens when I migrate to managed identity authentication?

When you migrate to managed identity authentication, Container Insights changes how it authenticates with Azure Monitor. This migration doesn't change your applications, workloads, or Kubernetes resources beyond the Container Insights monitoring configuration.

What stays the same

• You keep your existing Log Analytics workspace and previously collected monitoring data.

• Container Insights keeps collecting and sending monitoring data after migration.

• Existing dashboards, workbooks, alerts, and queries that use Container Insights data keep working as long as data is collected successfully after migration.

• You don't need to change your application code or workloads.

What changes

• Container Insights stops using legacy authentication and starts using managed identity authentication.

• Your cluster monitoring configuration is updated to use the supported authentication model required for future Container Insights functionality and support.

Migration impact

During migration, data collection might be temporarily interrupted while the monitoring configuration is updated. After migration, verify that monitoring data is flowing to your workspace and that your expected monitoring experiences are functioning correctly.

Recommended validation after migration

After migrating, validate that:

• Container Insights reports health and telemetry successfully.

• New logs and metrics arrive in your Log Analytics workspace.

• Any custom monitoring configurations continue to function as expected.

• Existing alerts, dashboards, and operational workflows continue to receive data.

Enable legacy authentication

If you require legacy authentication, see Enable Container insights, which has examples of different options for enabling Container insights.

Next steps

If you experience issues when you upgrade the agent, review the troubleshooting guide for support.