|
| 1 | +--- |
| 2 | +title: Troubleshoot Microsoft Entra Authentication Issues |
| 3 | +description: Provides general recommendations and specific suggestions for Microsoft Entra authentication issues. |
| 4 | +ms.date: 10/03/2025 |
| 5 | +ms.service: azure-monitor |
| 6 | +ms.custom: sap:Microsoft Entra authentication fails |
| 7 | +--- |
| 8 | + |
| 9 | +# Troubleshoot Microsoft Entra authentication issues |
| 10 | + |
| 11 | +This articles provides distinct troubleshooting scenarios and steps that you can take to resolve an issue before you raise a support ticket. |
| 12 | + |
| 13 | +## Ingestion HTTP errors |
| 14 | + |
| 15 | +The ingestion service returns specific errors, regardless of the SDK language. Network traffic can be collected by using a tool such as Fiddler. You should filter traffic to the ingestion endpoint set in the connection string. |
| 16 | + |
| 17 | +### HTTP/1.1 400 Authentication not supported |
| 18 | + |
| 19 | +This error shows the resource is set for Microsoft Entra-only. You need to correctly configure the SDK because it's sending to the wrong API. |
| 20 | + |
| 21 | +> [!NOTE] |
| 22 | +> "v2/track" doesn't support Microsoft Entra ID. When the SDK is correctly configured, telemetry is sent to `v2.1/track`. |
| 23 | +
|
| 24 | +Next, you should review the SDK configuration. |
| 25 | + |
| 26 | +### HTTP/1.1 401 Authorization required |
| 27 | + |
| 28 | +This error indicates that the SDK is correctly configured but it's unable to acquire a valid token. This error might indicate an issue with Microsoft Entra ID. |
| 29 | + |
| 30 | +Next, you should identify exceptions in the SDK logs or network errors from Azure Identity. |
| 31 | + |
| 32 | +### HTTP/1.1 403 Unauthorized |
| 33 | + |
| 34 | +This error means the SDK uses credentials without permission for the Application Insights resource or subscription. |
| 35 | + |
| 36 | +First, check the Application Insights resource's access control. You must configure the SDK with credentials that have the Monitoring Metrics Publisher role. |
| 37 | + |
| 38 | +## Language-specific troubleshooting |
| 39 | + |
| 40 | +## [ASP.NET Core](#tab/aspnetcore) |
| 41 | + |
| 42 | +The Application Insights .NET SDK emits error logs by using the event source. To learn more about collecting event source logs, see [Troubleshooting no data - collect logs with PerfView](asp-net-troubleshoot-no-data.md#PerfView). |
| 43 | + |
| 44 | +If the SDK fails to get a token, the exception message is logged as |
| 45 | +`Failed to get AAD Token. Error message:`. |
| 46 | + |
| 47 | +## [.NET](#tab/net) |
| 48 | + |
| 49 | +### Event source |
| 50 | + |
| 51 | +The Application Insights .NET SDK emits error logs by using the event source. To learn more about collecting event source logs, see [Troubleshooting no data - collect logs with PerfView](asp-net-troubleshoot-no-data.md#PerfView). |
| 52 | + |
| 53 | +If the SDK fails to get a token, the exception message is logged as |
| 54 | +`Failed to get AAD Token. Error message:`. |
| 55 | + |
| 56 | +## [Java](#tab/java) |
| 57 | + |
| 58 | +### HTTP traffic |
| 59 | + |
| 60 | +You can inspect network traffic by using a tool like Fiddler. To enable the traffic to tunnel through Fiddler, either add the following proxy settings in the configuration file: |
| 61 | + |
| 62 | +```JSON |
| 63 | +"proxy": { |
| 64 | +"host": "localhost", |
| 65 | +"port": 8888 |
| 66 | +} |
| 67 | +``` |
| 68 | + |
| 69 | +Or add the following Java Virtual Machine (JVM) args while running your application: `-Djava.net.useSystemProxies=true -Dhttps.proxyHost=localhost -Dhttps.proxyPort=8888` |
| 70 | + |
| 71 | +If Microsoft Entra ID is enabled in the agent, outbound traffic includes the HTTP header `Authorization`. |
| 72 | + |
| 73 | +### 401 Unauthorized |
| 74 | + |
| 75 | +If you see the message, `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 401, please check your credentials` in the log, it means the agent couldn't send telemetry. You likely didn't enable Microsoft Entra authentication on the agent, while your Application Insights resource has `DisableLocalAuth: true`. Ensure you pass a valid credential with access permission to your Application Insights resource. |
| 76 | + |
| 77 | +If you're using Fiddler, you might see the response header `HTTP/1.1 401 Unauthorized - please provide the valid authorization token`. |
| 78 | + |
| 79 | +### CredentialUnavailableException |
| 80 | + |
| 81 | +If you see the exception, `com.azure.identity.CredentialUnavailableException: ManagedIdentityCredential authentication unavailable. Connection to IMDS endpoint cannot be established` in the log file, it means the agent failed to acquire the access token. The likely cause is an invalid client ID in your User-Assigned Managed Identity configuration. |
| 82 | + |
| 83 | +### Failed to send telemetry |
| 84 | + |
| 85 | +If you see the message, `WARN c.m.a.TelemetryChannel - Failed to send telemetry with status code: 403, please check your credentials` in the log, it means the agent couldn't send telemetry. The likely reason is that the credentials used don't allow telemetry ingestion. |
| 86 | + |
| 87 | +Using Fiddler, you might notice the response `HTTP/1.1 403 Forbidden - provided credentials do not grant the access to ingest the telemetry into the component`. |
| 88 | + |
| 89 | +The issue could be due to: |
| 90 | + |
| 91 | +* Creating the resource with a system-assigned managed identity or associating a user-assigned identity without adding the Monitoring Metrics Publisher role to it. |
| 92 | +* Using the correct credentials for access tokens but linking them to the wrong Application Insights resource. Ensure your resource (virtual machine or app service) or user-assigned identity has Monitoring Metrics Publisher roles in your Application Insights resource. |
| 93 | + |
| 94 | +### Invalid Client ID |
| 95 | + |
| 96 | +If the exception, `com.microsoft.aad.msal4j.MsalServiceException: Application with identifier <CLIENT_ID> was not found in the directory` in the log, it means the agent failed to get the access token. This exception likely happens because the client ID in your client secret configuration is invalid or incorrect. |
| 97 | + |
| 98 | +This issue occurs if the administrator doesn't install the application or no tenant user consents to it. It also happens if you send your authentication request to the wrong tenant. |
| 99 | + |
| 100 | +## [Java native](#tab/java-native) |
| 101 | + |
| 102 | +Microsoft Entra ID authentication isn't available for GraalVM Native applications. |
| 103 | + |
| 104 | +## [Node.js](#tab/nodejs) |
| 105 | + |
| 106 | +Turn on internal logs by using the following setup. After you enable them, the console shows error logs, including any error related to Microsoft Entra integration. Examples include failing to generate the token with the wrong credentials or errors when the ingestion endpoint fails to authenticate using the provided credentials. |
| 107 | + |
| 108 | +```javascript |
| 109 | +let appInsights = require("applicationinsights"); |
| 110 | +appInsights.setup("InstrumentationKey=00000000-0000-0000-0000-000000000000;IngestionEndpoint=https://xxxx.applicationinsights.azure.com/").setInternalLogging(true, true); |
| 111 | +``` |
| 112 | + |
| 113 | +## [Python](#tab/python) |
| 114 | + |
| 115 | +### Error starts with "credential error" (with no status code) |
| 116 | + |
| 117 | +Something is incorrect about the credential you're using and the client isn't able to obtain a token for authorization. It's because the required data is lacking for the state. An example would be passing in a system `ManagedIdentityCredential` but the resource isn't configured to use system-managed identity. |
| 118 | + |
| 119 | +### Error starts with "authentication error" (with no status code) |
| 120 | + |
| 121 | +The client failed to authenticate with the given credential. This error usually occurs when the credential used doesn't have the correct role assignments. |
| 122 | + |
| 123 | +### I'm getting a status code 400 in my error logs |
| 124 | + |
| 125 | +You're probably missing a credential or your credential is set to `None`, but your Application Insights resource is configured with `DisableLocalAuth: true`. Make sure you're passing in a valid credential and that it has permission to access your Application Insights resource. |
| 126 | + |
| 127 | +### I'm getting a status code 403 in my error logs |
| 128 | + |
| 129 | +This error usually occurs when the provided credentials don't grant access to ingest telemetry for the Application Insights resource. Make sure your Application Insights resource has the correct role assignments. |
| 130 | + |
| 131 | +--- |
0 commit comments