Skip to main content
1

Create an app registration

In Azure, create an app registration with a client secret, then assign it the roles below.
2

Connect

Go to Connections, click Connect next to Azure Monitor, and enter the tenant ID, application (client) ID, client secret, subscription ID, region, and Log Analytics workspace ID.
3

Choose sources (optional)

After connecting, the Azure sources panel lists every subscription, Log Analytics workspace and Azure Monitor workspace the app can see. Select the ones Ordyn may read. Each source shows whether your current roles already cover it, and the exact command to run if they don’t.

​
Permissions

The app registration needs Log Analytics Reader and Monitoring Reader at subscription scope (workspace scope is not enough), plus Monitoring Contributor on the resource group for Ordyn’s alert rules if Auto Monitors is on. Managed Prometheus uses Monitoring Data Reader on each selected Azure Monitor workspace.

​
Infrastructure inventory

List resources in every selected subscription. Granted by: Monitoring Reader. Permissions Ordyn uses: Microsoft.Resources/subscriptions/resources/read.

​
Resource configuration

Read resource configuration through ARM and Resource Graph. Granted by: Monitoring Reader. Permissions Ordyn uses: */read.

​
Metrics

Read metric definitions and time series. Granted by: Monitoring Reader. Permissions Ordyn uses: Microsoft.Insights/metricDefinitions/read, Microsoft.Insights/metrics/read.

​
Logs

Query the primary and selected Log Analytics workspaces with KQL. Permissions Ordyn uses: Microsoft.OperationalInsights/workspaces/query/read.

​
Infrastructure change history

Read subscription Activity Log management events. Granted by: Monitoring Reader. Permissions Ordyn uses: Microsoft.Insights/eventtypes/values/read.

​
Managed Prometheus metrics

Only needed for selected Azure Monitor workspaces: run PromQL. Ordyn checks each workspace with a live read and asks for a data grant where Azure denies it. Granted by: Monitoring Data Reader. Permissions Ordyn uses: Microsoft.Monitor/accounts/data/metrics/read.

​
Manage Prometheus alerts

Only needed for Managed Prometheus: manage native rule groups in the alert resource group. Granted by: Monitoring Contributor. Permissions Ordyn uses: Microsoft.AlertsManagement/prometheusRuleGroups/write, Microsoft.AlertsManagement/prometheusRuleGroups/delete.

​
Manage monitoring

Manage Ordyn’s alert rules and the action group that delivers alerts to Ordyn, in the resource group you choose. Permissions Ordyn uses: Microsoft.Insights/metricAlerts/write, Microsoft.Insights/metricAlerts/delete, Microsoft.Insights/scheduledQueryRules/write, Microsoft.Insights/scheduledQueryRules/delete, Microsoft.Insights/actionGroups/write.
  • The two reader roles must be at subscription scope: Ordyn lists the subscription’s workspaces and reads alert rules across the subscription. Only the write role is narrowed to a resource group.
  • Managed Prometheus is optional. Apply its workspace data grant once for each selected Azure Monitor workspace. The Azure sources panel checks actual PromQL access and shows source-specific grant commands when needed.

​
How to grant

Replace the values in angle brackets. Permission catalog version 2026-10-16.1. See permission changes.

​
Selected sources

The Azure sources panel checks each selected workspace and shows a grant command for its exact scope when access is missing. Prometheus is optional; select its workspaces after connecting, then verify their PromQL access. Source selection controls discovery and direct query targets. Cross-workspace KQL and saved functions can still read resources allowed by the connection’s Azure roles. Use Azure role assignments to enforce data access boundaries. Ordyn requests tokens for https://prometheus.monitor.azure.com with the same client secret. Workspaces with public network access disabled also require a network path from Ordyn; role grants alone do not make them reachable.

​
What Ordyn reads

  • Log Analytics tables through KQL: application logs, diagnostic logs, and resource logs from App Service, Functions, AKS, and other services.
  • Metrics and existing alert rules through Monitoring Reader, in every selected subscription.
  • Managed Prometheus series through PromQL, such as AKS container metrics or Temporal task queue backlog, from each selected Azure Monitor workspace.
Auto Monitors can create Prometheus rule groups for signals that live in Managed Prometheus. Each group is created in the Ordyn resource group, evaluated by Azure against the selected workspace, and notifies Ordyn through the same action group as other alert rules.