Manage your Azure connections

Latest Dynatrace
How-to guide

Once you have successfully onboarded your Azure environment, it becomes a Healthy Azure connection.

Manage an existing Azure connection

The Azure connections table in Settings > Cloud and Virtualization > Azure is your cockpit for managing all the Azure connections.

The Filter all columns field allows you to swiftly filter connections. For example, enter Healthy and it will retrieve all connections with Healthy status.

Select a connection to explore it further by accessing the details window with the Overview, Health, Subscriptions, and Logs and events tabs.

Overview

The Overview tab provides a comprehensive view of your Azure connection's status and configuration.

Telemetry signal charts

The overview displays two real-time charts that show the status of signal ingest over the last 30 minutes:

Azure topology: Displays the number of topology updates received. Use this to verify that resource discovery is working correctly.
Azure Monitor metrics: Displays the count of metrics ingested. Use this to monitor metric collection health and identify changes after enabling new Azure services.

Connection properties

The properties section displays key metadata about your Azure connection:

Property	Description
Connection name	The display name for your connection. Select the pencil icon to rename it.
Application (client) ID	The Application (client) ID of the Azure service principal used for authentication.
Principal (object) ID	The object ID of the Azure service principal. May be empty if the object ID could not be resolved.
Monitoring Configuration ID	The ID of the monitoring configuration associated with this connection.
HAS Connection ID	The Dynatrace cloud monitoring connection identifier.
Deployment scope	The Azure scope at which the connection was deployed (for example, Management Group or Subscription).

Property	Description
Credential type	The authentication method: Client secret or Federated credential.
Created by	The Dynatrace user who created the connection.
Subscriptions	The number of Azure subscriptions being monitored through this connection.
Last modified	The date and time when the connection configuration was last changed.
Created	The date and time when the connection was initially created.

If the Principal (object) ID is not shown in the connection properties, retrieve it using the Azure CLI with the Application (client) ID:

az ad sp show --id <application-client-id> --query id -o tsv

Health

The Health tab provides visibility into connection health and helps you troubleshoot issues.

General section

The General section displays three key health indicators:

Indicator	Description
Status	Current connection health status with a descriptive message (for example, "Connection is healthy and data is being ingested.")
Entra ID authentication errors	Count of authentication errors over the last 6 hours. A chart displays error distribution over time.
Throttling events	Count of Azure API throttling events over the last 6 hours. A chart shows when throttling occurred.

Connection status types

There are several connection status types:

Pending: During onboarding, the connection is initially in the Pending status until all onboarding steps are completed.
Healthy: The Dynatrace SaaS platform successfully authenticated using the provided Azure credentials. This does not necessarily mean that all signals are successfully polled or ingested.
Unhealthy: The Dynatrace SaaS platform was unable to authenticate using the provided Azure credentials. The connection is not functioning correctly.
Inactive: A user-generated status when a connection is disabled. All poll-based signal ingest is suspended. You cannot change monitoring settings or view the health status while in this state.

Connection logs

The Connection logs section displays a searchable table of log events related to your connection. Use this to investigate errors and troubleshoot issues.

The log table includes the following columns:

Column	Description
`timestamp`	The date and time when the event occurred.
`da.clouds.status`	The status of the event (for example, `ERROR`, `INFO`).
`da.clouds.source`	The source component (for example, `azure-metric-poller`).
`da.clouds.content`	A brief description of the event (for example, `Throttling`).

You can:

Search and filter log entries using the search field.
Open logs in other tools using the Open with option.
Show or hide additional columns.
Adjust the number of rows displayed per page.

Throttling events in the connection logs are normal in large Azure environments where the volume of API calls approaches Azure API rate limits. If you see occasional Throttling log entries, no action is required — Dynatrace automatically retries throttled requests.

Note that free and trial Azure subscriptions have lower Azure API rate limits than paid subscriptions, so throttling may occur more frequently in those environments. See Azure Resource Manager request limits for details on the limits that apply to your subscription type.

Microsoft Entra ID authentication and authorization

A Healthy connection indicates successful authentication against your Microsoft Entra ID tenant.

When transitioning to an Unhealthy status, authentication errors appear in the Entra ID authentication errors chart and are logged to the connection logs section.

Service principal permissions may change over time. Missing Azure RBAC permissions do not impact connection status but will affect functionality.

Subscriptions

The Subscriptions tab lists all Azure subscriptions monitored through this connection.

Use the Search subscriptions field to filter by name or ID, and the Show all dropdown to filter by status. Select Open with to open the subscription list in another Dynatrace app.

Column	Description
Subscription name	The display name of the Azure subscription.
Subscription ID	The unique identifier of the Azure subscription.
Status	`Monitored`: The subscription is actively monitored by this connection.
Alerts configured	The number of alerts configured for this subscription. Select the count to view them.

The table shows the timestamp of the last data refresh in the upper-right corner.

Logs and events

The Logs and events tab shows the deployment status of log ingestion infrastructure across your Azure regions.

Use the Search by locations field to filter by region name, and the status filter dropdown to show all locations or only those with a specific deployment status (for example, Show deployed).

Column	Description
Location	Monitored Azure regions for this connection.
Status	`Deployed`: Log ingestion infrastructure is active in this region. `Not deployed`: No infrastructure exists for this region yet.
Forwarders	The number of log forwarders deployed in this region. Hover over the count to see the names of the deployed Event Hub namespaces.

To deploy log ingestion infrastructure to additional regions, see Azure logs and events.

Customize your monitoring settings

To customize your monitoring settings, select Manage in the upper-right corner of the overview window. Your current settings depend on your onboarding flow.

In the Manage window, you can customize the following settings:

Azure Monitor metrics

Use this section to enable or disable Azure services and configure their metric collection sets.

Enabling services: Schedules the metric poller to fetch Azure Monitor metrics at 5-minute intervals.
Monitored regions: Limits metric polling to specific Azure regions you choose to enable.

Monitored regions do not affect the topology service. Topology polling covers the entire tenant based on the permissions granted to the service principal.

Azure tag enrichment

Use this section to specify Azure tag keys that enrich supported signals such as Azure Monitor metrics.

Tag (key + value) length cannot exceed 23 characters.
Tags must use allowed characters: ^[a-zA-Z0-9_.: -/]*$

Tag enrichment notes

Changes can take up to 15 minutes to propagate.
Tag enrichment requires the signal to be linked to an entity.

Dynatrace attribute enrichment

This feature enables advanced platform use cases by enriching signals with well-known Dynatrace attributes. This supports capabilities such as fine-grained permissions.

You can set attribute values in two ways:

Literal values: Specify a custom arbitrary value directly.
Azure tag: Reference an Azure tag key name, which resolves to the tag value at runtime.

These capabilities are powered by primary Grail tags.

When using Azure tags for attribute enrichment, changes can take up to 15 minutes to propagate.

Delete a connection

Connections may need to be deleted and/or re-created. To completely delete a connection:

In the Azure Portal

Log in to your Azure Portal and go to Microsoft Entra ID > App Registrations.
Search for the related app registration matching your Dynatrace Azure connection.
Select Delete.

In Dynatrace

Go to Settings > Cloud and Virtualization > Azure to access all Azure connections.
Find and select the connection action menu on the right.
Select Delete.

Deleting a connection from Dynatrace does not delete any Azure resources created during onboarding (Event Hubs namespaces, resource groups, role assignments). To avoid ongoing Azure charges, manually delete the associated resource groups in the Azure Portal.

Disable a connection

You may face use cases which require disabling a connection

Sudden API throttling due to multiple Azure API consumers.
Sudden rise in signals ingest count which cannot be attributed to configuration changes on your side.
Act upon a request from a Dynatrace support specialist, for troubleshooting purposes.
Suspend the connection due to maintenance work on the Azure subscription.

If you disable a connection, its status will change into Inactive.

A disabled connection in an Inactive status does NOT delete existing data points or any configurations. It only suspends the connection.

To disable a connection

Go to Settings > Cloud and Virtualization > Azure to access all Azure connections.
Find and select the connection action menu on the right.
Select Disable.

To resume the suspended connection

Go to Settings > Cloud and Virtualization > Azure to access all Azure connections.
Find and select the connection action menu on the right.
Select Enable.

The enabled connection will change from Inactive to either Healthy or Unhealthy.

Paths and customizations

Path/Signal	Onboarding²/Recommended path	Onboarding³/Advanced path	Management path⁴
Azure metrics (poll-based)
Azure logs and events (poll-based, Event Hubs)
Topology¹ (poll-based)
Monitoring settings customization	Azure Regions only

—Auto-enabled (not possible to disable/configure)

—Fully customizable

Topology is core auto-enabled signal in all paths; it's not possible to disable it.

The Recommended path auto-enables signals with customizations possible after a successful onboarding.

The Advanced path allows you to customize most of the signals as well as monitoring settings while onboarding.

⁴

In connection management, it's possible to customize all supported monitoring settings features.