How to forward logs from Azure K8s Engine Diagnostic Settings to Event Hub using managed identity

Hi Flavio Duarte,

Thank you for reaching out to the Microsoft QA team. This issue occurs because Azure Monitor diagnostic settings authenticate to Event Hubs at the namespace level, not the individual Event Hub. If the managed identity only has permissions on the Event Hub instance, authentication fails and Event Hub reports User Errors.

1.Assign the role at the Event Hub namespace scope:

az role assignment create \
  --assignee <managed_identity_principal_id> \
  --role "Azure Event Hubs Data Sender" \
  --scope "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.EventHub/namespaces/<namespace>"

1. Verify the diagnostic setting is using Managed Identity:

az monitor diagnostic-settings list --resource <aks_resource_id>

If eventHubAuthorizationRuleId is present, the setting is still using SAS. Recreate the diagnostic setting and select Managed Identity.

3.Wait a few minutes for RBAC changes to propagate.

User Errors metric drops to zero

Logs start flowing normally to Event Hub using managed identity

Hope this helps. Please let us know if you have any questions and concerns.

Hi Flavio Duarte,

The reason you don’t see a Managed Identity option in the Azure Portal is that the portal experience for AKS diagnostic settings does not currently expose Managed Identity in all regions/tenants. To configure MI, you must use the Azure CLI or ARM API.

1.Assign the role at the Event Hubs namespace scope
Diagnostic settings authenticate at the namespace level.

az role assignment create \
  --assignee <managed_identity_principal_id> \
  --role "Azure Event Hubs Data Sender" \
  --scope "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.EventHub/namespaces/<namespace>"

2.Remove the existing diagnostic setting(It is still using as SAS)

az monitor diagnostic-settings delete \
  --name "<setting_name>" \
  --resource <aks_resource_id>

3. Recreate the diagnostic setting using Manged Identity

az monitor diagnostic-settings create \
  --name "aks-to-eventhub-mi" \
  --resource <aks_resource_id> \
  --event-hub-namespace "<namespace_name>" \
  --managed-identity "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<identity_name>" \
  --logs '[{"category":"kube-apiserver","enabled":true}]'

Note: If your Azure CLI version does not show --managed-identity, run az upgrade or use an ARM template, because MI support is available but not fully surfaced in older CLI builds.

4.Verify that Managed Identity is active

az monitor diagnostic-settings list --resource <aks_resource_id> -o json | \
  jq '.[] | {managedIdentity: .managedIdentity, eventHubAuthorizationRuleId: .eventHubAuthorizationRuleId}'

Expected:

managedIdentity → populated

eventHubAuthorizationRuleId → null (means SAS is not being used)

If Managed Identity still cannot be selected
This is expected in some portal experiences. In that case, either:

1.use CLI / ARM (supports MI correctly), or

2.use a namespace-level SAS policy as a fallback (fully supported and reliable).

Helpful References
1.https://learn.microsoft.com/en-us/azure/event-hubs/authenticate-managed-identity
2.https://learn.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings?tabs=portal
3. https://learn.microsoft.com/en-us/azure/azure-monitor/platform/stream-monitoring-data-event-hubs

Please let us know if you have any questions and concerns.