Appinsights Instrumentation Skill Security Audit

5152> ⚠️ **Warning:** Built-in metrics cover infrastructure only. For request-level tracing, response times, and dependency tracking, add Application Insights SDK.5354## Application Insights SDK Setup5556Set `APPLICATIONINSIGHTS_CONNECTION_STRING` as an environment variable on the container app, then add the SDK per language:57

3637System logs capture events outside your code—replica scheduling, health probe results, and revision activation. Console logs capture everything your app writes to stdout/stderr.38

1819The App Insights resource has a connection string. Add the connection string as an environment variable of the running app. You can use Azure CLI to query the connection string of the App Insights resource. See [scripts/appinsights.ps1](../scripts/appinsights.ps1) for what Azure CLI command to execute for querying the connection string.2021After getting the connection string, set this environment variable with its value.2223```24"APPLICATIONINSIGHTS_CONNECTION_STRING={your_application_insights_connection_string}"25```2627If the app has IaC template such as Bicep or terraform files representing its cloud instance, this environment variable should be added to the IaC template to be applied in each deployment. Otherwise, use Azure CLI to manually apply the environment variable to the cloud instance of the app. See [scripts/appinsights.ps1](../scripts/appinsights.ps1) for what Azure CLI command to execute for setting this environment variable.28

6465```bash66# Store as a secret (recommended — keeps value out of az show output and portal config)67az containerapp secret set -n <app-name> -g <rg> \68  --secrets "appinsights-conn=<conn-string>"6970az containerapp update \71  --name <app-name> \72  --resource-group <rg> \73  --set-env-vars "APPLICATIONINSIGHTS_CONNECTION_STRING=secretref:appinsights-conn"74```

1415# Set environment variable of Container App16# Or update an existing container app17az containerapp update -n $containerAppName -g $resourceGroupName --set-env-vars $key=$value1819# Set environment variable of Function App20az functionapp config appsettings set --name $functionName --resource-group $ResourceGroupName --settings $key=$value21

4950### Manually instrument5152Manually instrument the app by creating the AppInsights resource and update the app's code. 5354#### Create AppInsights resource5556Use one of the following options that fits the environment.5758- Add AppInsights to existing Bicep template. See [examples/appinsights.bicep](examples/appinsights.bicep) for what to add. This is the best option if there are existing Bicep template files in the workspace.59- Use Azure CLI. See [scripts/appinsights.ps1](scripts/appinsights.ps1) for what Azure CLI command to execute to create the App Insights resource.60

910- Configure the app to use Azure Monitor11An ASP.NET Core app typically has a Program.cs file that "builds" the app. Find this file and apply these changes.12  - Add `using Azure.Monitor.OpenTelemetry.AspNetCore;` at the top13  - Before calling `builder.Build()`, add this line `builder.Services.AddOpenTelemetry().UseAzureMonitor();`.1415> Note: since we modified the code of the app, the app needs to be deployed to take effect.16

2526## When to Use azure-prepare Instead2728- User says "add telemetry to my app"29- User says "add App Insights" 30- User wants to modify their project31- Any request to change/add components32

6263#### Modify application code6465- If the app is an ASP.NET Core app, see [ASPNETCORE guide](references/aspnetcore.md) for how to modify the C# code.66- If the app is a Node.js app, see [NODEJS guide](references/nodejs.md) for how to modify the JavaScript/TypeScript code.67- If the app is a Python app, see [PYTHON guide](references/python.md) for how to modify the Python code.68

1112# Set environment variable of App Service13az webapp config appsettings set --resource-group $resourceGroupName --name $appName --settings $key=$value1415# Set environment variable of Container App16# Or update an existing container app17az containerapp update -n $containerAppName -g $resourceGroupName --set-env-vars $key=$value1819# Set environment variable of Function App20az functionapp config appsettings set --name $functionName --resource-group $ResourceGroupName --settings $key=$value21

67// Create Log Analytics Workspace8resource logAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {9  name: '${name}-workspace'10  location: location11  properties: {12    sku: {13      name: 'PerGB2018'14    }15    retentionInDays: 3016  }

5556Use one of the following options that fits the environment.5758- Add AppInsights to existing Bicep template. See [examples/appinsights.bicep](examples/appinsights.bicep) for what to add. This is the best option if there are existing Bicep template files in the workspace.59- Use Azure CLI. See [scripts/appinsights.ps1](scripts/appinsights.ps1) for what Azure CLI command to execute to create the App Insights resource.60

3az extension add -n application-insights4## Create a Log Analytics workspace5az monitor log-analytics workspace create --resource-group $resourceGroupName --workspace-name $logAnalyticsWorkspaceName --location $azureRegionName6## Create the Application Insights resource7az monitor app-insights component create --app $applicationInsightsResourceName --location $azureRegionName --resource-group $resourceGroupName --workspace $logAnalyticsWorkspaceName8

11  properties: {12    sku: {13      name: 'PerGB2018'14    }15    retentionInDays: 3016  }