[8.19](backport #48880) [Azure App Insights] add support for Client Secret

[mergify]

Proposed commit message

Add support for client secret authentication in Azure App Insights

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Use cases

- module: azure
  metricsets:
    - app_insights
  enabled: true
  period: 300s
  application_id: ''
  # auth_type: "api_key" (default) or "client_secret"
  auth_type: "client_secret"
  client_id: '${AZURE_CLIENT_ID:""}'
  client_secret: '${AZURE_CLIENT_SECRET:""}'
  tenant_id: '${AZURE_TENANT_ID:""}'
  #active_directory_endpoint: ''
  #api_key: ''
  metrics:
    - id: ["requests/count", "requests/duration"]
      segment: ["request/name"]

Backward Compatibility

Only api_key set up in the configuration

- module: azure
  metricsets:
    - app_insights
  enabled: true
  period: 60s
  application_id: ''
  # auth_type: "api_key" (default) or "client_secret"
  #auth_type: "api_key"
  #client_id: '${AZURE_CLIENT_ID:""}'
  #client_secret: '${AZURE_CLIENT_SECRET:""}'
  #tenant_id: '${AZURE_TENANT_ID:""}'
  #active_directory_endpoint: ''
  api_key: 'xxxxx'
  metrics:
    - id: ["requests/count", "requests/duration"]
      segment: ["request/name"]

Screenshots

Client Secret

Api Key

Logs

Client Secret Logs

{"log.level":"debug","@timestamp":"2026-03-09T16:53:18.731+0100","log.logger":"azure.app_insights","log.origin":{"function":"github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/app_insights.getAuthorizer","file.name":"app_insights/service.go","file.line":58},"message":"Using client secret authentication for App Insights","service.name":"metricbeat","ecs.version":"1.6.0"}

> {"log.level":"debug","@timestamp":"2026-03-09T16:53:18.732+0100","log.logger":"azure.app_insights","log.origin":{"function":"github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/app_insights.getAuthorizer","file.name":"app_insights/service.go","file.line":58},"message":"Using client secret authentication for App Insights","service.name":"metricbeat","ecs.version":"1.6.0"}

{"log.level":"debug","@timestamp":"2026-03-09T16:53:18.732+0100","log.logger":"azure.app_insights.module","log.origin":{"function":"github.com/elastic/beats/v7/metricbeat/mb/module.(*metricSetWrapper).run","file.name":"module/wrapper.go","file.line":220},"message":"Starting metricSetWrapper[module=azure, name=app_insights, host=]","service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2026-03-09T16:53:48.735+0100","log.logger":"monitoring","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*Reporter).logSnapshot","file.name":"log/log.go","file.line":187},"message":"Non-zero metrics in the last 30s","service.name":"metricbeat","monitoring":{"metrics":{"metricbeat":{"azure":{"app_insights":{"events":1,"success":1}}}},"ecs.version":"1.6.0"}}

---

Api Key Logs

{"log.level":"debug","@timestamp":"2026-03-09T17:44:53.504+0100","log.logger":"azure.app_insights","log.origin":{"function":"github.com/elastic/beats/v7/x-pack/metricbeat/module/azu re/app_insights.getAuthorizer","file.name":"app_insights/service.go","file.line":61},"message":"Using API key authentication for App Insights","service.name":"metricbeat","ecs.version":"1.6.0"}

> {"log.level":"debug","@timestamp":"2026-03-09T17:44:53.504+0100","log.logger":"azure.app_insights","log.origin":{"function":"github.com/elastic/beats/v7/x-pack/metricbeat/module/azure/app_insights.getAuthorizer","file.name":"app_insights/service.go","file.line":61},"message":"Using API key authentication for App Insights","service.name":"metricbeat","ecs.version":"1.6.0"}

{"log.level":"debug","@timestamp":"2026-03-09T17:44:53.504+0100","log.logger":"azure.app_insights.module","log.origin":{"function":"github.com/elastic/beats/v7/metricbeat/mb/module.
(*metricSetWrapper).run","file.name":"module/wrapper.go","file.line":220},"message":"Starting metricSetWrapper[module=azure, name=app_insights,
host=]","service.name":"metricbeat","ecs.version":"1.6.0"}

{"log.level":"info","@timestamp":"2026-03-09T17:48:23.509+0100","log.logger":"monitoring","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*Repor
ter).logSnapshot","file.name":"log/log.go","file.line":187},"message":"Non-zero metrics in the last 30s","service.name":"metricbeat","monitoring":{"metrics":{"beat":{"cpu":{"system"
:{"ticks":139,"time":{"ms":7}},"total":{"ticks":447,"time":{"ms":10},"value":447.5425416666666},"user":{"ticks":307,"time":{"ms":2}}},"info":{"ephemeral_id":"22f40622-ddf3-44d8-8549
-df43d4bc5351","uptime":{"ms":210113},"version":"9.4.0"},"memstats":{"gc_next":24875050,"memory_alloc":12452352,"memory_total":146460576,"rss":74399744},"runtime":{"goroutines":21}}

,"libbeat":{"config":{"module":{"running":1}},"output":{"events":{"acked":1,"active":0,"batches":1,"total":1},"read":{"bytes":176,"errors":1},"write":{"bytes":1400,"latency":{"histo
gram":{"count":4,"max":268,"mean":78.75,"median":18,"min":11,"p75":205.5,"p95":268,"p99":268,"p999":268,"stddev":109.30090347293567}},"latency_delta":{"histogram":{"count":1,"max":1
8,"median":18,"min":18,"p99":18}}}},"pipeline":{"clients":1,"events":{"active":0,"published":1,"total":1},"queue":{"acked":1,"added":{"bytes":1595,"events":1},"consumed":{"bytes":15
95,"events":1},"filled":{"bytes":0,"events":0,"pct":0},"max_bytes":0,"max_events":3200,"removed":{"bytes":1595,"events":1}}}},"metricbeat":{"azure":{"app_insights":{"events":1,"succ
ess":1}}},"system":{"load":{"1":3.3511,"15":4.5615,"5":4.0386,"norm":{"1":0.2793,"15":0.3801,"5":0.3365}}}},"ecs.version":"1.6.0"}}

---

This is an automatic backport of pull request #48880 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of 73c3663 has failed:

On branch mergify/bp/8.19/pr-48880
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit 73c3663e8.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   changelog/fragments/1771338300-app_insights_oauth2.yaml
	modified:   x-pack/metricbeat/metricbeat.reference.yml
	modified:   x-pack/metricbeat/module/azure/_meta/config.reference.yml
	modified:   x-pack/metricbeat/module/azure/_meta/config.yml
	modified:   x-pack/metricbeat/module/azure/app_insights/app_insights.go
	modified:   x-pack/metricbeat/module/azure/app_insights/client_test.go
	modified:   x-pack/metricbeat/module/azure/app_insights/service.go
	new file:   x-pack/metricbeat/module/azure/app_insights/service_test.go
	modified:   x-pack/metricbeat/modules.d/azure.yml.disabled

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   docs/reference/metricbeat/metricbeat-metricset-azure-app_insights.md
	deleted by us:   docs/reference/metricbeat/metricbeat-module-azure.md
	deleted by us:   x-pack/metricbeat/module/azure/app_insights/_meta/docs.md

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[botelastic]

This pull request doesn't have a Team:<team> label.

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[github-actions]

Vale Linting Results

Summary: 3 warnings, 8 suggestions found

⚠️ Warnings (3)

File	Line	Rule	Message
docs/reference/metricbeat/metricbeat-module-azure.md	32	Elastic.DontUse	Don't use 'Please'.
docs/reference/metricbeat/metricbeat-module-azure.md	41	Elastic.DontUse	Don't use 'and/or'.
docs/reference/metricbeat/metricbeat-module-azure.md	68	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.

💡 Suggestions (8)

File	Line	Rule	Message
docs/reference/metricbeat/metricbeat-metricset-azure-app_insights.md	78	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
docs/reference/metricbeat/metricbeat-metricset-azure-app_insights.md	106	Elastic.WordChoice	Consider using 'refer to (if it's a document), view (if it's a UI element)' instead of 'see', unless the term is in the UI.
docs/reference/metricbeat/metricbeat-module-azure.md	29	Elastic.Wordiness	Consider using 'to' instead of 'in order to'.
docs/reference/metricbeat/metricbeat-module-azure.md	32	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
docs/reference/metricbeat/metricbeat-module-azure.md	87	Elastic.Wordiness	Consider using 'to' instead of 'in order to'.
docs/reference/metricbeat/metricbeat-module-azure.md	90	Elastic.Wordiness	Consider using 'to' instead of 'in order to'.
docs/reference/metricbeat/metricbeat-module-azure.md	93	Elastic.Wordiness	Consider using 'to' instead of 'in order to'.
docs/reference/metricbeat/metricbeat-module-azure.md	93	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.