Azure Writer Authentication
UNIFYConnect supports explicit Azure authentication choices for Azure-backed log and audit writers. The selected mode determines which Azure Identity credential is created; choosing Workload identity or Managed identity does not use the default credential chain.
The authentication selection is available for:
- Azure Log Analytics Log Writer when using the DCR API
- Azure Log Analytics Audit Writer when using the DCR API
- Data Explorer Log Writer
- Inbuilt Data Explorer Log Writer
The legacy Azure Log Analytics writer uses its workspace ID and shared key and is not affected by this setting.
Authentication Modes
| Mode | Credential used | Configuration fields |
|---|---|---|
| Default Azure credential chain | DefaultAzureCredential | No credential override fields are displayed. The first credential available in the host's default Azure Identity chain is used. |
| Workload identity | WorkloadIdentityCredential | Tenant ID and client ID are optional overrides. The host must supply a federated token file and any values not overridden in UNIFYConnect. |
| Managed identity | ManagedIdentityCredential | Client ID is optional. Leave it blank to use the system-assigned identity, or enter the client ID of a user-assigned managed identity. |
| Client secret | ClientSecretCredential | Tenant ID, client ID, and client secret are required. |
Select an explicit mode when the deployment must always use a particular identity mechanism. For example, select Workload identity for an AKS workload configured with Microsoft Entra Workload ID. This prevents another credential available to the host from being selected first by the default credential chain.
TIP
Credential fields that are shown in the UI support External Value Store references. This includes environment-variable-backed external values.
Host and Azure Configuration
UNIFYConnect does not create an Azure identity or grant it access. Configure the selected identity in the hosting environment and grant it the roles required by the destination:
- Data Explorer requires permission to query the database and ingest into the configured table. The setup commands on the Data Explorer Log Writer page use the database viewer and table ingestor roles.
- Azure Log Analytics DCR writers require permission to submit data through the configured data collection rule. The setup guides use the Monitoring Metrics Publisher role on the DCR.
For workload identity, the federated token file must be available to the UNIFYConnect process. Tenant ID and client ID can be supplied by the host environment or overridden in the writer configuration.
For managed identity, the identity must be assigned to the Azure resource that hosts UNIFYConnect. If more than one user-assigned identity is available, provide its client ID to select it unambiguously.