How to access Azure Monitor Workspace (Managed Prometheus) metrics from Grafana installed via Helm on AKS?

Question

How to access Azure Monitor Workspace (Managed Prometheus) metrics from Grafana installed via Helm on AKS?

Thiago Pereira da Silva 45

I'm having trouble integrating Grafana with the new Azure Monitor Workspace.

I have a self-hosted Grafana instance installed via Helm in my AKS cluster. Currently, I use it to query Log Analytics tables like Perf and InsighMetrics to get metrics from my pods.

However, with recent AKS versions, when enabling Azure Monitor Managed Prometheus, metrics are stored in a new Azure Monitor Workspace, and tables like Perf and InsightMetrics are no longer available in the traditional Log Analytics workspace.

I'm fine with this new approach, but the issue is that my Grafana instance running in AKS cannot access the metrics stored in the new Azure Monitor Workspace.

My question is: Is there a way to configure my self-hosted Grafana (not Managed Grafana) to access metrics from the Azure Monitor Workspace with Managed Prometheus? I’d prefer not to rely on Managed Grafana for this.

Note: I know I can revert my monitoring to Log Analytics visualizations (Classic), but I would like to know if there's a way to use data from the Azure Monitor Workspace directly.

Hazem Ali 80 Reputation points MVP

2025-06-04T12:39:15.43+00:00
First, Get the Prometheus endpoint

In Azure Monitor workspace → Overview, copy the “Prometheus query endpoint” URL.

Then, Assign permissions

In the workspace’s IAM, give Grafana’s identity (e.g. an Azure AD–backed “workload identity” in AKS) the Monitoring Metrics Reader role.

Lastly, Configure Grafana data source

In Grafana → Configuration → Data Sources → Add → Prometheus

Set URL to the Prometheus endpoint you copied

Under Auth, choose Azure AD (or Managed/Workload Identity) so Grafana can fetch a token automatically

Save & Test

Once that’s done,

Grafana can query the managed Prometheus metrics in your Azure Monitor workspace.
Thiago Pereira da Silva 45 Reputation points

2025-06-04T12:49:10.45+00:00

In my case, the Azure AD authentication option is not available under the Prometheus data source settings in Grafana. I believe this is because I'm using the open-source version of Grafana installed via Helm, not the Enterprise version. That option might only be available in Grafana Enterprise or Managed Grafana on Azure.
Anonymous

2025-06-04T14:37:18.47+00:00
Hi @Thiago Pereira da Silva,

when you're running open-source Grafana via Helm in AKS, you won’t see or be able to use options like:

Azure Authentication” or “Managed Identity” under Prometheus data source

Azure Monitor plugin with native Azure AD integration

Since you don’t want to use Managed Grafana, here’s a concrete breakdown of what you can do with OSS Grafana:

Option A: Reverse Proxy with Token Injection

Set up a small proxy service that:

Authenticates to Azure AD using a Managed Identity (via Azure Workload Identity).

Fetches a token for [https://monitor.azure.com/.default.]("https://monitor.azure.com/.default%60.")

Forwards requests to the Prometheus endpoint, injecting the Authorization: Bearer <token> header.

Grafana points to this proxy as if it's just a Prometheus server.

This makes Azure AD token injection transparent to Grafana.

Example Architecture

Grafana (OSS)

↓ Reverse Proxy (e.g., Node.js, nginx + Lua, or oauth2-proxy variant)

↓ Azure Monitor Prometheus Endpoint

You can deploy this proxy in your AKS cluster and use Azure Workload Identity, so it never handles static credentials.

Option B: Remote-Write Metrics to Local Prometheus

Instead of pulling metrics into Grafana:

Configure Azure Monitor Managed Prometheus to remote_write to your own Prometheus server running in the cluster.

Grafana connects to that Prometheus instance — all standard, no Azure AD involved.

If the answer is helpful, please do "Upvote it".
Anonymous

2025-06-06T10:28:44.2833333+00:00

Hi @Thiago Pereira da Silva

I just wanted to check if the above provided information worked for you or if you need any further assistance?

Please feel free to let us know, as we are always here to help whenever you need us.

Please do not forget to “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.
Thiago Pereira da Silva 45 Reputation points

2025-06-06T12:24:30.6533333+00:00

Thank you very much for the detailed suggestions.

However, I was really hoping for something simpler, more straightforward solution, since I'm using Azure cloud services, I expected the integration with Grafana to be a bit more straightforward. Both Option A and Option B seem to introduce a level of complexity and increased cost that I would prefer to avoid for now. Because of that, I haven’t tried them, so I can’t confirm whether they work or not.

For now, I’ll just keep using my self-hosted Grafana with Log Analytics (Classic) while it’s still available.

Appreciate the help!
Arko 4,185 Reputation points Moderator

2025-06-09T12:02:37.55+00:00
Hello Thiago Pereira da Silva,

When using the open-source version of Grafana installed via Helm in AKS, it is not currently possible to directly connect to the Azure Monitor Workspace (Managed Prometheus) using the Prometheus query endpoint, because Azure Monitor requires Azure Active Directory (Azure AD) token-based authentication, and the OSS Grafana Prometheus data source does not support Azure AD or Managed Identity authentication mechanisms.

The ability to authenticate using Azure Workload Identity or Azure AD tokens is only available in Azure Managed Grafana or Grafana Enterprise, which include official Azure Monitor and Azure authentication plugins. As a result, self-hosted Grafana cannot natively issue the required Bearer token to query the secured Azure Monitor Prometheus endpoint.

To work around this limitation while continuing to use self-hosted Grafana, there are currently only two supported architectural approaches:

Deploy a reverse proxy that handles Azure AD authentication: You can deploy a small proxy service within your AKS cluster that uses Azure Workload Identity to fetch access tokens for the https://monitor.azure.com/.default scope. This proxy injects the Authorization: Bearer <token> header into requests and forwards them to the Azure Monitor Workspace Prometheus endpoint. Grafana connects to this proxy as if it were a standard Prometheus instance. This method enables seamless integration but requires maintaining an additional component.

Configure remote_write from Azure Monitor to a local Prometheus instance: Azure Monitor Managed Prometheus supports remote write. You can configure it to forward metrics to a Prometheus server that you deploy and manage inside your AKS cluster. Grafana can then connect to this local Prometheus instance without requiring any Azure-specific authentication. This eliminates the need for token injection but requires operating and scaling your own Prometheus backend.

As of now, there is no simpler or native method to access Azure Monitor Workspace metrics from OSS Grafana, and reverting to Log Analytics remains a temporary alternative. For a fully integrated experience without maintaining workarounds, migrating to Azure Managed Grafana is the recommended approach supported by Microsoft. Thanks.
Anonymous

2025-06-10T04:11:15.6433333+00:00

Hi Thiago Pereira da Silva

Just checking if the provided workaround resolved your issue. If it did, please let us know. If you have any questions or concerns, please respond, and we will take further steps. -Thank you.
Anonymous

2025-06-11T04:40:57.68+00:00

Hi Thiago Pereira da Silva

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
Thiago Pereira da Silva 45 Reputation points

2025-06-11T12:39:48.0933333+00:00

Hi!
As I previously mentioned, I was hoping for a simpler solution. As this is not currently available, I will continue using Grafana with Log Analytics (Classic) for now. Therefore, I cannot say whether this works or not, as I haven’t tested it.
Thank you for your messages and support.
Anonymous

2025-06-12T03:51:15.1733333+00:00

Hi Thiago Pereira da Silva

Thank you for your update, Since the suggested approach is somehow complex and it will increase the cost efficiency, however you're looking for simple configurations along with less cost optimization but since you're running on classic for now which works just fine. in future if you are getting any blockers with your current environment refer the above provided suggestions or file a new support ticket for guidance, we will be happy to help you out.

-Thank you.
Ajay Yadav 0 Reputation points

2026-02-19T12:11:37.8533333+00:00

i see Grafana introduced specific plugin for azure managed promethus: https://grafana.com/docs/grafana/latest/datasources/prometheus/configure/azure-authentication/
and when I installed this plugin I can see option of workload identity but I am facing issue in make the connection. I am attaching the data source ui and help configuration.

Let me know if its the issue with plugin. I am using workload identity to fetch the promql data.
one more point. I can successfully use azure monitor data source. its able to authenticate

Your answer

Hazem Ali 80 Reputation points MVP

2025-06-04T12:39:15.43+00:00

First, Get the Prometheus endpoint

In Azure Monitor workspace → Overview, copy the “Prometheus query endpoint” URL.

Then, Assign permissions

In the workspace’s IAM, give Grafana’s identity (e.g. an Azure AD–backed “workload identity” in AKS) the Monitoring Metrics Reader role.

Lastly, Configure Grafana data source

In Grafana → Configuration → Data Sources → Add → Prometheus

Set URL to the Prometheus endpoint you copied

Under Auth, choose Azure AD (or Managed/Workload Identity) so Grafana can fetch a token automatically

Save & Test

Once that’s done,

Grafana can query the managed Prometheus metrics in your Azure Monitor workspace.
Thiago Pereira da Silva 45 Reputation points

2025-06-04T12:49:10.45+00:00

In my case, the Azure AD authentication option is not available under the Prometheus data source settings in Grafana. I believe this is because I'm using the open-source version of Grafana installed via Helm, not the Enterprise version. That option might only be available in Grafana Enterprise or Managed Grafana on Azure.
Anonymous

2025-06-04T14:37:18.47+00:00

Hi @Thiago Pereira da Silva,

when you're running open-source Grafana via Helm in AKS, you won’t see or be able to use options like:

Azure Authentication” or “Managed Identity” under Prometheus data source

Azure Monitor plugin with native Azure AD integration

Since you don’t want to use Managed Grafana, here’s a concrete breakdown of what you can do with OSS Grafana:

Option A: Reverse Proxy with Token Injection

Set up a small proxy service that:

Authenticates to Azure AD using a Managed Identity (via Azure Workload Identity).

Fetches a token for [https://monitor.azure.com/.default.]("https://monitor.azure.com/.default%60.")

Forwards requests to the Prometheus endpoint, injecting the Authorization: Bearer <token> header.

Grafana points to this proxy as if it's just a Prometheus server.

This makes Azure AD token injection transparent to Grafana.

Example Architecture

Grafana (OSS)

↓ Reverse Proxy (e.g., Node.js, nginx + Lua, or oauth2-proxy variant)

↓ Azure Monitor Prometheus Endpoint

You can deploy this proxy in your AKS cluster and use Azure Workload Identity, so it never handles static credentials.

Option B: Remote-Write Metrics to Local Prometheus

Instead of pulling metrics into Grafana:

Configure Azure Monitor Managed Prometheus to remote_write to your own Prometheus server running in the cluster.

Grafana connects to that Prometheus instance — all standard, no Azure AD involved.

If the answer is helpful, please do "Upvote it".
Anonymous

2025-06-06T10:28:44.2833333+00:00

Hi @Thiago Pereira da Silva

I just wanted to check if the above provided information worked for you or if you need any further assistance?

Please feel free to let us know, as we are always here to help whenever you need us.

Please do not forget to “upvote it” wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.
Thiago Pereira da Silva 45 Reputation points

2025-06-06T12:24:30.6533333+00:00

Thank you very much for the detailed suggestions.

However, I was really hoping for something simpler, more straightforward solution, since I'm using Azure cloud services, I expected the integration with Grafana to be a bit more straightforward. Both Option A and Option B seem to introduce a level of complexity and increased cost that I would prefer to avoid for now. Because of that, I haven’t tried them, so I can’t confirm whether they work or not.

For now, I’ll just keep using my self-hosted Grafana with Log Analytics (Classic) while it’s still available.

Appreciate the help!
Anonymous

2025-06-10T04:11:15.6433333+00:00

Hi Thiago Pereira da Silva

Just checking if the provided workaround resolved your issue. If it did, please let us know. If you have any questions or concerns, please respond, and we will take further steps. -Thank you.
Anonymous

2025-06-11T04:40:57.68+00:00

Hi Thiago Pereira da Silva

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.
Thiago Pereira da Silva 45 Reputation points

2025-06-11T12:39:48.0933333+00:00

Hi!
As I previously mentioned, I was hoping for a simpler solution. As this is not currently available, I will continue using Grafana with Log Analytics (Classic) for now. Therefore, I cannot say whether this works or not, as I haven’t tested it.
Thank you for your messages and support.
Anonymous

2025-06-12T03:51:15.1733333+00:00

Hi Thiago Pereira da Silva

Thank you for your update, Since the suggested approach is somehow complex and it will increase the cost efficiency, however you're looking for simple configurations along with less cost optimization but since you're running on classic for now which works just fine. in future if you are getting any blockers with your current environment refer the above provided suggestions or file a new support ticket for guidance, we will be happy to help you out.

-Thank you.
Ajay Yadav 0 Reputation points

2026-02-19T12:11:37.8533333+00:00

i see Grafana introduced specific plugin for azure managed promethus: https://grafana.com/docs/grafana/latest/datasources/prometheus/configure/azure-authentication/
and when I installed this plugin I can see option of workload identity but I am facing issue in make the connection. I am attaching the data source ui and help configuration.

Let me know if its the issue with plugin. I am using workload identity to fetch the promql data.
one more point. I can successfully use azure monitor data source. its able to authenticate