Repository navigation
Update AI Gateway monitoring to use the current OpenTelemetry configuration #9
Description
Problem
The sample currently configures telemetryExporters with kind: applicationInsights and an Application Insights connection string. The current AI Gateway monitoring experience expects the native OTLP/OpenTelemetry configuration, so the portal does not reliably recognize this legacy exporter as monitoring-enabled.
Missing configuration
- Register the
Microsoft.Monitorresource provider. - Set
AzureMonitorWorkspaceIngestionMode: Enabledon the workspace-based Application Insights resource. - Wait for Application Insights to generate its managed DCR/DCE and OTLP endpoints.
- Configure the exporter with
kind: OpenTelemetry, the Application Insights resource ID, metrics/logs/traces OTLP endpoints, and managed-identity audiencehttps://monitor.azure.com. - Assign the AI Gateway system-assigned identity the Monitoring Metrics Publisher role (
3913510d-42f4-4e42-8a64-420c390055eb) at the generated DCR scope. - Account for the deny assignment on the generated managed resource group: a nested ARM/Bicep role assignment is blocked, while a direct role-assignment PUT from an
azdpost-provision hook works. - Document that exporter
kindis immutable, requiring delete/recreate when migrating an existing legacy exporter.
Current preview behavior
The service currently persists metrics and logs endpoints but may omit a supplied tracesEndpoint from exporter GET responses. Metrics and logs are sufficient for the portal dashboard eligibility check.
Activity
paulyuk commentedon Oct 25, 2026
@copilot Please implement this on top of current
main(which uses the standaloneMicrosoft.ApiManagement/aigateways@2025-09-01-previewresource provider from #23):Bicep (
infra/ai-gateway/main.bicep&infra/main.bicep):AzureMonitorWorkspaceIngestionMode: 'Enabled'ongatewayAppInsights(Microsoft.Insights/components@2020-02-02) with#disable-next-line BCP037documented.kind: 'applicationInsights'gatewayTelemetryExporterresource frominfra/ai-gateway/main.bicep(since OTLP DCR/DCE endpoints and managed resource group role assignments must be configured postprovision).AI_GATEWAY_APP_INSIGHTS_ID,AI_GATEWAY_LOG_ANALYTICS_WORKSPACE_ID, andAI_GATEWAY_PRINCIPAL_ID(fromaiGateway.identity.principalId) so the postprovision script can configure the OTLP exporter.Postprovision hooks (
infra/scripts/configure-ai-gateway.sh&infra/scripts/configure-ai-gateway.ps1):ENABLE_MONITORINGis enabled, registerMicrosoft.Monitorif not already registered, pollgatewayAppInsightsuntil its managed DCR/DCE and OTLP endpoints (IngestionEndpoint,MetricsIngestionEndpoint,LogsIngestionEndpoint,TracesIngestionEndpoint,DefaultDataCollectionRuleResourceId) are populated.3913510d-42f4-4e42-8a64-420c390055eb) to the AI Gateway system-assigned principal ID at the generated DCR scope via direct REST/CLI PUT.telemetryExporters/applicationInsightsresource haskind != "OpenTelemetry", delete it first (sincekindis immutable), then PUTMicrosoft.ApiManagement/aigateways/{gatewayName}/telemetryExporters/applicationInsights?api-version=2025-09-01-previewwithkind: "OpenTelemetry", the Application Insights resource ID, OTLP endpoints, and managed-identity authentication (audience: "https://monitor.azure.com").Tests & docs:
tests/test-ai-gateway-model-registration.sh,IMPLEMENTATION_NOTES.md, andinfra/ai-gateway/README.mdto reflect the native OpenTelemetry exporter setup.