This guide is for managing the integration between Azure and Datadog in the Azure portal using the Datadog resource. The Datadog resource in Azure represents the connection between a Datadog organization and an Azure subscription. Create a Datadog resource in Azure before proceeding with this guide.
With the Datadog resource, you can manage the following within the associated Azure subscription:
This page describes the Azure Portal experience. If you prefer to use CLI, see the Azure CLI for Datadog.
Select “Overview” in the left sidebar to view information for your Datadog resource.
The overview page displays essential information about your Datadog resource including: resource group name, location (region), subscription, tags, Datadog organization link, status, pricing plan, and billing term.
Note: The Datadog organization link is a SAML link if SSO is enabled. If the Datadog organization was created with the Azure marketplace, set a password the first time you use this link.
The overview page provides links to view Datadog dashboards, logs, and host maps.
The overview page provides a summary table of the resources sending logs and metrics to Datadog. This table includes the following columns:
| Column | Description |
|---|---|
| Resource type | The Azure resource type |
| Total resources | The count of all resources for the resource type |
| Logs to Datadog | The count of resources sending logs to Datadog through the integration |
| Metrics to Datadog | The count of resources sending metrics to Datadog through the integration |
To stop sending logs and metrics from Azure to Datadog, select “Disable” on the overview page, then click “OK”.
Note: Disabling the Datadog resource stops the submission of metrics and platform logs to Datadog for the associated subscription. Any resources in the subscription submitting data directly to Datadog through the Agent or extension are unaffected.
To start sending logs and metrics from Azure to Datadog, select “Enable” on the overview page, then click “OK”. Any previous configuration for logs and metrics is retrieved and enabled.
To delete the Datadog resource, select “Delete” on the overview page. Confirm deletion by typing yes, then click “Delete”.
For Datadog organizations billed through the Azure Marketplace:
If your Datadog organization is NOT billed through the Azure Marketplace, deleting a Datadog resource just removes the integration for that Azure subscription.
Select “Change Plan” on the overview page to change your Datadog billing plan.
The portal retrieves all the available Datadog plans for your tenant, this includes any private offers. Select the appropriate plan and click “Change Plan”.
Select “Metrics and logs” in the left sidebar to change the configuration rules for metrics and logs. All rules are applied dynamically across the entire subscription as resources are added or tags change.
Changes to metric or log configuration settings should take effect within a few minutes.
By default, Datadog automatically collects metrics for all Azure resources within the subscription.
Optionally, limit metric collection for Azure VMs and App Service Plans using Azure tags attached to your resources.
include tags send metrics to Datadog.exclude tags don’t send metrics to Datadog.There are three types of logs that can be emitted from Azure to Datadog using the Datadog resource.
Subscription level logs provide insight into the operations on your resources at the control plane. Updates on service health events are also included. Use the activity log to determine the what, who, and when for any write operations (PUT, POST, DELETE).
To send subscription level logs to Datadog, select “Send subscription activity logs”. If this option is left unchecked, none of the subscription level logs are sent to Datadog.
Azure resource logs provide insight into operations taken on Azure resources at the data plane. For example, getting a secret from a key vault or making a request to a database are data plane operations. The content of resource logs varies by the Azure service and resource type.
To send Azure resource logs to Datadog, select “Send Azure resource logs for all defined resources”. The types of Azure resource logs are listed in the Azure Monitor Resource Log categories. When this option is selected, all resource logs are sent to Datadog, including any new resources created in the subscription.
You can optionally filter the set of Azure resources sending logs to Datadog using Azure resource tags.
include tags send logs to Datadog.exclude tags don’t send logs to Datadog.For example, the screenshot below shows a tag rule where only virtual machines, virtual machine scale sets, and app service plans tagged with Datadog = True send metrics to Datadog. Resources (of all types) tagged with Datadog = True send logs to Datadog.
Azure Active Directory (Azure AD) logs contain the history of sign-in activity and an audit trail of changes made in Azure AD for a particular tenant. To send Azure AD Logs:
All Azure AD logs from the tenant are sent to the Datadog organization linked to the Datadog resource selected. For cases where you have more than one Datadog resource that link subscriptions to the same Datadog organization, it does not matter which Datadog resource is selected. You only need to set this up once for each Azure tenant.
Select “Monitored Resources” in the left sidebar to see a list of resources emitting logs and metrics to Datadog. Use the search to filter the list by resource name, type, group, location, logs to Datadog, or metrics to Datadog.
The “Logs to Datadog” column displays Sending if the resource is sending logs to Datadog. Otherwise, this field indicates why logs aren’t being sent. Possible reasons:
| Reason | Description |
|---|---|
| Resource doesn’t support sending logs | Only resource types with monitoring log categories can be configured to send logs to Datadog. |
| Limit of five diagnostic settings reached | Each Azure resource can have a maximum of five diagnostic settings. For more information, see diagnostic settings. |
| Error | The resource is configured to send logs to Datadog, but is blocked by an error. |
| Logs not configured | Only Azure resources with appropriate resource tags are configured to send logs to Datadog. |
| Region not supported | The Azure resource is in a region that doesn’t support sending logs to Datadog. |
| Datadog Agent not configured | Virtual machines without the Datadog Agent installed don’t emit logs to Datadog. |
To see a list of virtual machines (VMs) in the subscription, select “Virtual machine agent” in the left sidebar. On this page, you can install the Datadog Agent on a VM as an extension.
For each VM, the following information is displayed:
| Column | Description |
|---|---|
| Resource name | The VM’s name |
| Resource status | Whether the VM is stopped or running. The Datadog Agent can only be installed on a running VM. If the VM is stopped, installing the Datadog Agent is disabled. |
| Agent version | The Datadog Agent version number |
| Agent status | Whether the Datadog Agent is running on the VM. |
| Integrations enabled | The key metrics being collected by enabled integrations in the Datadog Agent. |
| Install method | The specific tool used to install the Datadog Agent, such as Chef, Azure VM extension, etc. |
| Sending logs | Whether the Datadog Agent is sending logs to Datadog. |
To install the Datadog Agent, select the appropriate VM, then click “Install Agent”. The portal asks for confirmation to install the Agent with the default key. Select “OK” to begin installation. Azure shows the status as Installing until the Agent is installed and provisioned. After the Datadog Agent is installed, the status changes to Installed.
If the Datadog Agent was installed with the Azure VM extension, you can uninstall the Agent by selecting the appropriate VM, then click “Uninstall Agent”.
If the Agent was installed using a different method, you can not use the Datadog resource to deploy or remove the Agent, but information about the Agent is still reflected on this page.
Select “App Service extension” in the left sidebar to see a list of app services in the subscription. On this page, you can install the Datadog extension on Azure App Service to enable APM tracing and custom metrics.
For each app service, the following information is displayed:
| Column | Description |
|---|---|
| Resource name | The app name |
| Resource status | Whether the app service is stopped or running. The app service must be running to initiate install. If the app service is stopped, installing the Datadog Agent is disabled. |
| App service plan | The specific plan configured for the app service |
| Extension version | The Datadog extension version number |
To install the Datadog extension, select the appropriate app, then click “Install Extension”. The portal asks for confirmation to install the extension. Select “OK” to begin installation. This restarts your app and adds the following settings:
DD_API_KEY:<DEFAULT_API_KEY>DD_SITE:us3.datadoghq.comDD_LOGS_INJECTION:trueAzure shows the status as Installing until the Agent is installed and provisioned. After the Datadog Agent is installed, the status changes to Installed.
Note: Ensure you are adding the extension to apps with supported runtimes. The Datadog resource does not limit or filter the list of apps.
To uninstall the Datadog extension, select the appropriate app, then click “Uninstall Extension”.
Select “Single sign-on” in the left sidebar to reconfigure single sign-on.
To activate single sign-on through Azure Active Directory, select “Enable single sign-on”. The portal retrieves the appropriate Datadog application from Azure Active Directory. The app name is the enterprise app name you chose when setting up the integration. Select the Datadog application name as shown below:
Select “Keys” in the left sidebar to view a list of API keys for your Datadog resource.
The Azure portal provides a read-only view of the API keys. To manage the keys, select the “Datadog portal” link. After making changes in Datadog, refresh the Azure portal view.
The Azure Datadog integration allows you to install the Datadog Agent on a VM or app service. If there is no default key selected, a Datadog Agent installation fails.
Select Cloud Security Posture Management in the left sidebar to configure Cloud Security Posture management.
By default, CSPM is not enabled. To enable CSPM, select Enable Datadog Cloud Security Posture Management and click Save. This enables Datadog CSPM for any subscriptions associated with the Datadog resource.
To disable, uncheck the box and click Save.
Additional helpful documentation, links, and articles:
