Manage your Azure connections Settings app

Latest Dynatrace
How-to guide

Once you have successfully onboarded your Azure environment, it becomes a Healthy Azure connection.

Manage an existing Azure connection

The Azure connections table in Settings > Cloud and virtualization > Azure is your cockpit for managing all the Azure connections.

The Filter all columns field allows you to swiftly filter connections. For example, enter Healthy and it will retrieve all connections with Healthy status.

Select a connection to explore it further by accessing the details window with the Overview, Health, Subscriptions, and Logs and events tabs.

Overview

The Overview tab provides a comprehensive view of your Azure connection's status and configuration.

Telemetry signal charts

The overview displays three real-time charts that show the status of signal ingest over the last 30 minutes:

Azure topology: Displays the number of topology updates received. Use this to verify that resource discovery is working correctly.
Azure Monitor metrics: Displays the count of metrics ingested. Use this to monitor metric collection health and identify changes after enabling new Azure services.
Azure Logs and Events (Poll-based): Displays the count of logs and events ingested, charted separately. Use this to confirm that log and event forwarding is active.

Connection properties

The properties section displays key metadata about your Azure connection:

Property	Description
Connection name	The display name for your connection. Select the pencil icon to rename it.
Environment ID	The ID of the Dynatrace environment that hosts this connection.
Application (client) ID	The Application (client) ID of the Azure service principal used for authentication.
Principal (object) ID	The object ID of the Azure service principal. May be empty if the object ID could not be resolved.
Monitoring Configuration ID	The ID of the monitoring configuration associated with this connection.
HAS Connection ID	The Dynatrace cloud monitoring connection identifier.
Deployment scope	The Azure scope at which the connection was deployed (for example, Management Group or Subscription).

Property	Description
Credential type	The authentication method: Client secret or Federated credential.
Created by	The Dynatrace user who created the connection.
Subscriptions	The number of Azure subscriptions being monitored through this connection.
Last modified	The date and time when the connection configuration was last changed.
Created	The date and time when the connection was initially created.

If the Principal (object) ID is not shown in the connection properties, retrieve it using the Azure CLI with the Application (client) ID:

az ad sp show --id <application-client-id> --query id -o tsv

Health

The Health tab provides visibility into connection health and helps you troubleshoot issues.

General section

The General section displays three key health indicators:

Indicator	Description
Status	Current connection health status with a descriptive message (for example, "Connection is healthy and data is being ingested.")
Entra ID authentication errors	Count of authentication errors over the last 6 hours. A chart displays error distribution over time.
Throttling events	Count of Azure API throttling events over the last 6 hours. A chart shows when throttling occurred.

Connection status types

There are several connection status types:

Pending: During onboarding, the connection is initially in the Pending status until all onboarding steps are completed.
Healthy: The Dynatrace SaaS platform successfully authenticated using the provided Azure credentials. This does not necessarily mean that all signals are successfully polled or ingested.
Unhealthy: The Dynatrace SaaS platform was unable to authenticate using the provided Azure credentials. The connection is not functioning correctly.
Inactive: A user-generated status when a connection is disabled. All poll-based signal ingest is suspended. You can't change monitoring settings or view the health status while in this state.

Connection logs

The Connection logs section displays a searchable table of log events related to your connection. Use this to investigate errors and troubleshoot issues.

The log table includes the following columns:

Column	Description
`timestamp`	The date and time when the event occurred.
`da.clouds.status`	The status of the event (for example, `ERROR`, `INFO`).
`da.clouds.source`	The source component (for example, `azure-metric-poller`).
`da.clouds.content`	A brief description of the event (for example, `Throttling`).

You can:

Search and filter log entries using the search field.
Open logs in other tools using the Open with option.
Show or hide additional columns.
Adjust the number of rows displayed per page.

Throttling events in the connection logs are normal in large Azure environments where the volume of API calls approaches Azure API rate limits. If you see occasional Throttling log entries, no action is required — Dynatrace automatically retries throttled requests.

Note that free and trial Azure subscriptions have lower Azure API rate limits than paid subscriptions, so throttling may occur more frequently in those environments. See Azure Resource Manager request limits for details on the limits that apply to your subscription type.

Microsoft Entra ID authentication and authorization

A Healthy connection indicates successful authentication against your Microsoft Entra ID tenant.

When transitioning to an Unhealthy status, authentication errors appear in the Entra ID authentication errors chart and are logged to the connection logs section.

Service principal permissions may change over time. Missing Azure RBAC permissions do not impact connection status but will affect functionality. A Healthy connection can still fail to ingest logs and events if the service principal lacks the roles listed in Azure permissions.

Subscriptions

The Subscriptions tab lists all Azure subscriptions monitored through this connection.

Use the Search subscriptions field to filter by name or ID, and the status dropdown to filter by status. Select Open with to open the subscription list in another Dynatrace app, or Create health alerts to set up alerting.

Column	Description
Subscription name	The display name of the Azure subscription.
Subscription ID	The unique identifier of the Azure subscription.
Status	`Monitored`: The subscription is actively monitored by this connection.
Ingest distribution	The share of this subscription's ingested telemetry that arrives through this connection.
Ingest activity	A sparkline of recent ingest volume for this subscription.
Alerts configured	The number of alerts configured for this subscription. Select the count to view them.

The table shows the timestamp of the last data refresh in the upper-right corner.

Logs and events

The Logs and events tab shows the deployment status of log ingestion infrastructure across your Azure regions.

Use the Search by locations field to filter by region name, and the status filter dropdown to show all locations or only those with a specific deployment status (for example, Show deployed).

Column	Description
Location	Monitored Azure regions for this connection.
Status	`Deployed`: Log ingestion infrastructure is active in this region. `Not deployed`: Dynatrace hasn't discovered log ingestion infrastructure in this region. Either no infrastructure is deployed yet, or deployed infrastructure can't be discovered. For example, because the Event Hubs namespace lacks the required Azure tags, the service principal lacks a read role covering the namespace, or a tag-based filter on this connection excludes the namespace (add `managed-by:dynatrace` to Include filters). For details, see Azure permissions and Troubleshooting.
Forwarders	The number of log forwarders deployed in this region. Hover over the count to see the names of the deployed Event Hub namespaces.

To deploy log ingestion infrastructure to additional regions, see Azure logs and events.

Customize your monitoring settings

To customize your monitoring settings, select Manage in the upper-right corner of the overview window. Your current settings depend on your onboarding flow.

In the Manage window, you can customize the following settings:

Monitored regions

Select the Azure regions that Dynatrace polls for both topology and Azure Monitor metrics. At least one region is required. The list also includes Global, an optional logical region for global nonregional services, which you don't deploy into a specific Azure region—for example, Azure Front Door and Azure Traffic Manager.

Dynatrace polls topology and metrics only in the regions you select. To keep telemetry in context and your resource inventory complete, select every region where you ingest any signal, including logs and events.

Azure Monitor metrics

Use this section to enable or disable Azure services and configure their metric collection sets. Enabling a service schedules the metric poller to fetch its Azure Monitor metrics at 5-minute intervals, in the monitored regions.

Tag-based filters

Use this section to include or exclude Azure resources from monitoring based on Azure tag key-value pairs.

Include filters: Dynatrace ingests signals only for resources carrying at least one of the listed tag pairs.
Exclude filters: Dynatrace ingests signals for all resources except those carrying at least one of the listed tag pairs.

Include filters and Exclude filters are separate fields, and you can populate either or both. This differs from Subscription filters, where include and exclude are mutually exclusive options.

Ingesting Azure logs or events?

If you use Include filters, add the tag managed-by:dynatrace. Without it, an include filter can exclude your Event Hubs namespace and the region shows Not deployed in the Logs and events tab. Adding it uses one of the five include filters. Alternatively, tag the namespace with a tag that's already in your Include filters. For details, see Event Hubs requirements.

Azure tag-based filters instruct the Dynatrace poll services to include or exclude signals for ingest based on Azure tag key-value pairs.

Filters apply to both metric ingest and topology ingest.
You can configure a maximum of five include and five exclude tag key-value pairs per connection.
Filters apply to Azure resources only and can't filter subscriptions. To stop monitoring an entire subscription, use Subscription filters.
Filters evaluate only the tags that Azure reports for the resource itself. Dynatrace doesn't add, derive, or inherit tags before filtering.

Why a resource is still monitored after you add an include filter

An include filter can only match a resource that Azure reports the tag for. A resource remains monitored when:

Its Azure resource type doesn't support tags. Many types—especially child types—have no tags property. For example, Microsoft.DBforPostgreSQL/flexibleServers supports tags, but Microsoft.DBforPostgreSQL/flexibleServers/configurations doesn't. To check a type, see Tag support for Azure resources.
The tag is set on the resource group or the parent resource, not on the resource. Azure resources don't inherit tags from a resource group or subscription, and Dynatrace doesn't propagate tags from a parent resource to its children. The same applies to resources in Azure-managed resource groups, such as the MC_<cluster-name>_<region> group that Azure Kubernetes Service creates. Dynatrace collects these resources together with their parent, but Azure doesn't inherit the parent's tags to them. Configure tag inheritance in Azure instead—see Configure tag inheritance in Azure.

Subscription filters

Use this section to limit monitoring scope to specific Azure subscription IDs, without changing the Azure RBAC permissions granted to the service principal.

Include filters: Monitor only the listed subscriptions.
Exclude filters: Monitor all discovered subscriptions except the listed ones.

Enter a subscription ID and select Tab or Enter to add it, then repeat for each subscription you want to filter.

Filter limit

Max of 10 subscription IDs are currently supported for include or exclude.

Excluding a subscription stops all data ingestion for that subscription through this connection. Monitored entities associated with that subscription become inactive in Dynatrace.

Azure tag enrichment

Use this section to specify Azure tag keys that enrich supported signals such as Azure Monitor metrics.

Tag (key + value) length can't exceed 23 characters.
Tags must use allowed characters: ^[a-zA-Z0-9_.: -/]*$

Tag enrichment notes

Changes can take up to 15 minutes to propagate.
Tag enrichment requires the signal to be linked to an entity.

Dynatrace attribute enrichment

This feature enables advanced platform use cases by enriching signals with well-known Dynatrace attributes. This supports capabilities such as fine-grained permissions.

You can set attribute values in two ways:

Literal values: Specify a custom arbitrary value directly.
Azure tag: Reference an Azure tag key name, which resolves to the tag value at runtime.

These capabilities are powered by primary Grail tags.

When using Azure tags for attribute enrichment, changes can take up to 15 minutes to propagate.

Delete a connection

Connections may need to be deleted and/or re-created. To completely delete a connection:

In the Azure portal

Go to Microsoft Entra ID > App Registrations.
Search for the related app registration matching your Dynatrace Azure connection.
Select Delete.

In Dynatrace

Go to Settings > Cloud and virtualization > Azure to access all Azure connections.
Find and select the connection action menu on the right.
Select Delete.

Deleting a connection from Dynatrace does not delete any Azure resources created during onboarding (Event Hubs namespaces, resource groups, role assignments). To avoid ongoing Azure charges, manually delete the associated resource groups in the Azure portal.

Disable a connection

You may face use cases which require disabling a connection

Sudden API throttling due to multiple Azure API consumers.
Sudden rise in signals ingest count which can't be attributed to configuration changes on your side.
Act upon a request from a Dynatrace support specialist, for troubleshooting purposes.
Suspend the connection due to maintenance work on the Azure subscription.

If you disable a connection, its status will change into Inactive.

A disabled connection in an Inactive status does NOT delete existing data points or any configurations. It only suspends the connection.

To disable a connection

Go to Settings > Cloud and virtualization > Azure to access all Azure connections.
Find and select the connection action menu on the right.
Select Disable.

To resume the suspended connection

Go to Settings > Cloud and virtualization > Azure to access all Azure connections.
Find and select the connection action menu on the right.
Select Enable.

The enabled connection will change from Inactive to either Healthy or Unhealthy.

Paths and customizations

Path/Signal	Onboarding²/Recommended path	Onboarding³/Advanced path	Management path⁴
Azure metrics (poll-based)
Azure logs and events (poll-based, Event Hubs)
Topology¹ (poll-based)
Monitoring settings customization	Azure Regions only

—Auto-enabled (not possible to disable/configure)

—Fully customizable

Topology is core auto-enabled signal in all paths; it's not possible to disable it.

The Recommended path auto-enables signals with customizations possible after a successful onboarding.

The Advanced path allows you to customize most of the signals as well as monitoring settings while onboarding.

⁴

In connection management, it's possible to customize all supported monitoring settings features.