In Azure

Your Microsoft Entra ID user needs the following permissions:

Permission to create an app registration

One of the following must be true for the user:

• Users can register applications has been set to Yes
• The user has the Application Developer role

Admin roles within your subscriptions

Within the subscriptions you wish to monitor, you must have either:

• The Owner role
• Both the Contributor and User Access Admin roles

Permission to add and grant consent for Graph API permissions

The Privileged Role Administrator role contains the required permissions.

In Datadog

The Datadog Admin Role, or any other role with the azure_configurations_manage permission.

Choose the Quickstart setup method if…

• You are setting up Datadog for the first time.
• You prefer a UI-based workflow and want to minimize the time it takes to create a service principal with the required monitoring permissions.
• You want to automate setup steps in scripts or CI/CD pipelines.

Instructions

1. In the Azure integration tile, click + Add New App registration, then select Quickstart.
2. Copy the setup script, and run it in the Azure Cloud shell.
3. Return to the Datadog UI. You should see CONNECTED at the top right corner of the setup script.
4. Select the subscriptions and management groups to collect data from.
5. Optionally, click the metric collection toggle to disable all metric collection from Azure. You can also expand the Advanced Configuration dropdown to filter metrics by:
   • Resource provider
   • Tags
   • Hosts
   • App Service Plans
   • Container Apps

You can also click to enable custom metric collection from Azure Application Insights, and disable the collection of usage metrics.

6. Optionally, click the resource collection toggle to disable the collection of configuration information from your Azure resources.

7. Enable log collection to set up and configure the services and diagnostic settings needed to forward logs to Datadog:

   1. If a log forwarder already exists in the tenant, it is modified to extend its scope. Any changed settings apply to existing as well as newly-selected subscriptions or management groups.
   2. If you’re creating a new log forwarder:
      1. Enter a resource group name to store the log forwarder control plane
      2. Select a control plane subscription for the log-forwarding orchestration (LFO).
      3. Select a region for the control plane.
         Note: The resource group name, control plane subscription, and region fields only appear when creating a new log forwarder.
   3. Optionally, open Log filtering options to filter logs by tags, or apply filtering for specific information (such as PII) using regex.

   See the Architecture section of the automated log forwarding guide for more information about this architecture.

8. Click Confirm to finish the setup.

Choose the Terraform setup method if…

• You manage infrastructure as code and want to keep the Datadog Azure integration under version control.
• You need to configure multiple tenants or subscriptions consistently with reusable provider blocks.
• You want a repeatable, auditable deployment process that fits into your Terraform-managed environment.

Instructions

Follow these steps to deploy the Datadog Azure integration through Terraform.

resource "datadog_integration_azure" "sandbox" {
  tenant_name   = "<AZURE_TENANT_NAME>"
  client_id     = "<AZURE_CLIENT_ID>"
  client_secret = "<AZURE_CLIENT_SECRET_KEY>"
}

Managing multiple subscriptions or tenants

You can use multiple provider blocks with aliases to manage Terraform resources across multiple subscriptions or tenants. Read Provider Configuration for more information.

Monitor the integration status

After the integration is configured, Datadog begins running a continuous series of calls to Azure APIs to collect critical monitoring data from your Azure environment. Sometimes these calls return errors (for example, if the provided credentials have expired). These errors can inhibit or block Datadog’s ability to collect monitoring data.

When critical errors are encountered, the Azure integration generates events in the Datadog Events Explorer, and republishes them every five minutes. You can configure an Event Monitor to trigger when these events are detected and notify the appropriate team.

Datadog provides a monitor template to help you get started. To use the monitor template:

1. In Datadog, go to Monitors and click the Browse Templates button.
2. Search for and select the monitor template titled [Azure] Integration Errors.
3. Make any desired modifications to the search query or alert conditions. By default, the monitor triggers whenever a new error is detected, and resolves when the error has not been detected for the past 15 minutes.
4. Update the notification and re-notification messages as desired. Note that the events themselves contain pertinent information about the event and are included in the notification automatically. This includes detailed information about the scope, error response, and common steps to remediate.
5. Configure notifications through your preferred channels (email, Slack, PagerDuty, or others) to make sure your team is alerted about issues affecting Azure data collection.

Choose the existing app registration setup method if..

• You already have an app registration configured with the Monitoring Reader role for Datadog to monitor the provided scope (subscriptions or management groups), and don’t want to create new resources.

If you need to set up an app registration for Datadog, see the Quickstart or Terraform setup methods.

Instructions

1. In the Datadog Azure integration tile, select Add Existing.
2. In the Tenant ID field, paste your Directory (tenant) ID.
3. In the Client ID field, paste the application (client) ID.
4. In the Client Secret Value field, paste the value of the app registration’s client secret.
5. Optionally, click the Monitor Automuting toggle to disable monitor automuting.
6. Optionally, click the metric collection toggle to disable all metric collection from Azure. You can also expand the Advanced Configuration dropdown to filter metrics by:
   • Resource provider
   • Tags
   • Hosts
   • App Service Plans
   • Container Apps

You can also click to enable custom metric collection from Azure Application Insights, and disable the collection of usage metrics.

6. Optionally, click the resource collection toggle to disable the collection of configuration information from your Azure resources.
7. Click Create Configuration.

Choose the automated log forwarding setup method if…

• You haven’t already set up logs through the Quickstart setup method.
• You prefer a UI-based workflow and want to minimize the time it takes to create a service principal with the required monitoring permissions.
• You want to automate setup steps in scripts or CI/CD pipelines.

Instructions

1. Open the Automated Log Forwarding ARM template in Azure.
2. Configure your Azure project and instance details on the Basics tab.
3. Enter your Datadog credentials on the Datadog Configuration tab.
4. Acknowledge deployment warnings on the Deployment tab.
5. Start the deployment process on the Review + create tab.

See Azure Automated Log Forwarding Architecture for more details.

Choose the Container App log forwarding method if…

• You prefer to manually configure diagnostic settings on the resources you want to forward logs from.

Instructions

1. Click the button below, and fill in the form on the Azure Portal. Datadog automatically deploys the Azure resources required to forward logs into your Datadog account.

   

2. After the template deployment finishes, set up diagnostic settings for each log source to send Azure platform logs (including resource logs) to the Storage Account created during deployment.

Note: Resources can only stream to a Storage Account in the same Azure region.