How to Set Up Azure Monitor as a Data Source in Grafana

This guide provides a step-by-step approach for setting up Azure Monitor as a data source in Grafana. It includes all the necessary configurations, from creating an Azure Service Principal to assigning permissions and troubleshooting potential issues.

Prerequisites

1. Grafana Instance running.
2. Azure Subscription with sufficient permissions to create and manage resources.
3. Azure Service Principal (App Registration) with required permissions to access Azure Monitor and Log Analytics workspaces.

Step 1: Install Azure Monitor Plugin in Grafana

1. Log in to Grafana.
2. Go to Configuration (⚙️) > Plugins.
3. Search for Azure Monitor.
4. If it’s not installed, click on Install to install the plugin.

Step 2: Add Azure Monitor as a Data Source in Grafana

1. In Grafana, go to Configuration (⚙️) > Data Sources.
2. Click on Add data source.
3. Search for Azure Monitor and select it.

Step 3: Create and Configure Azure Service Principal

Create Azure App Registration (Service Principal)

1. Log in to Azure Portal.
2. Navigate to Azure Active Directory > App registrations > New registration.
3. Provide a name (e.g., GrafanaMonitorApp), and click Register.
4. After registration, note the Application (client) ID and Directory (tenant) ID.

Create Client Secret for Authentication

1. In your App Registration, go to Certificates & Secrets > New client secret.
2. Copy the Value of the secret. You’ll need this to authenticate Grafana.

Assign Permissions to the Service Principal

1. Assign the Monitoring Reader Role to Azure Subscription:

   • Go to Azure Subscription > Access Control (IAM) > Add role assignment.
   • Select Monitoring Reader and assign it to the App Registration you just created.

2. Assign Log Analytics Reader Role to Log Analytics Workspace:

   • Navigate to Log Analytics workspaces in the Azure portal.
   • Select your workspace, then go to Access Control (IAM).
   • Click on Add role assignment, select Log Analytics Reader, and assign it to your App Registration.

3. Assign Reader Role to Azure Resource Graph (if needed):

   • Go to Azure Subscription > Access Control (IAM).
   • Click Add role assignment, select Reader, and assign it to the App Registration.

Step 4: Configure Azure Monitor Data Source in Grafana

1. In Grafana, under Azure Monitor data source settings:

   • Subscription ID: Enter your Subscription ID from the Azure Portal.
   • Tenant ID: Enter your Directory (tenant) ID from the App Registration.
   • Client ID: Enter your Application (client) ID from the App Registration.
   • Client Secret: Enter the Client Secret you generated earlier.

2. Under Azure Environment, select Azure Cloud unless you're using a different environment.

3. Click Save & Test to ensure the connection is successful.

Step 5: Troubleshoot Common Issues

1. Error: No Log Analytics Workspaces Found

   • Action: Ensure that at least one Log Analytics workspace exists in your Azure subscription.
   • Action: Confirm that your service principal has the Log Analytics Reader role assigned to the workspace.

2. Error: Access Denied to Resource Graph

   • Action: Assign the Reader role to your service principal at the Subscription or Resource Group level.

3. Error: Connection to Azure Resource Graph Failed

   • Action: Ensure that your service principal has the Reader role assigned at the subscription level.
   • Action: Ensure there are no firewall or network security group restrictions that could block the connection.

4. "Health Check Failed" During "Save & Test"

   • If the health check fails but shows that Azure Monitor endpoint is successfully connected, ensure your service principal has the required permissions for both Azure Monitor and Log Analytics Workspaces.

Step 6: Query Metrics in Grafana

Once Azure Monitor is successfully connected to Grafana:

1. Create a new Dashboard or go to Explore.
2. Choose Azure Monitor as the data source.
3. Select a Resource Type (e.g., Virtual Machines, Application Insights).
4. Choose the Metric you want to visualize.
5. Customize the query parameters and visualize the data as desired.

Final Considerations

• Propagation Time: Role assignments can take several minutes to propagate across Azure. Wait 10-15 minutes and try again if roles were recently assigned.
• Permissions: Ensure that the Service Principal has all the required roles: Monitoring Reader, Log Analytics Reader, and Reader for Azure Resource Graph.
• Network Configuration: Double-check that there are no network configurations blocking Grafana from accessing Azure services.
• Quota Limits: Ensure you are within your Azure service limits to avoid connection issues.

By following the above steps, you should be able to successfully configure Azure Monitor as a data source in Grafana and start visualizing Azure metrics and logs in your Grafana dashboards.