Azure Monitor AI Connector

Overview

The Azure Monitor AI connector lets Rootly AI investigate Azure resources with Microsoft’s public Azure Monitor, Log Analytics, Resource Manager, Resource Graph, and Resource Health APIs. Rootly calls those APIs directly; you don’t need to deploy or operate an MCP server.

Azure has two Rootly AI connectors. This native connector reads operational evidence directly from Azure APIs. Azure Resource Manager (MCP) uses Microsoft’s hosted MCP endpoint for resource inventory and deployment status. You can connect both.

An Azure alert source is a third, separate inbound integration that sends alerts to Rootly for routing and paging. See Alert Sources for the ingestion workflow. The connector is read-only. Microsoft Entra ID and Azure role-based access control (RBAC) authorize the Rootly enterprise application, while a second Rootly allowlist limits each AI investigation to the subscriptions, workspaces, resources, and capabilities selected for your Rootly team.

Contact your Rootly account team to receive the Rootly enterprise application consent link and application ID. After that one-time enrollment step, a Rootly admin configures and manages the connector from AI & Agents → Connectors.

Before You Start

You’ll need:

A Microsoft Entra administrator who can grant tenant-wide admin consent to the Rootly enterprise application.
Permission to look up the Rootly enterprise application in Microsoft Entra, or its tenant-specific service-principal object ID from your Entra administrator.
Permission to assign Azure roles at the scopes Rootly AI will investigate.
Rootly admin permission to manage AI connectors.
The tenant ID and subscription IDs for the Azure environment.
The workspace ID and full Azure Resource Manager ID for each Log Analytics workspace.
The full Azure Resource Manager ID for every resource Rootly AI may inspect.
A decision about which Azure evidence capabilities to enable.

The connector supports Microsoft Azure public cloud. Azure Government, Azure China, and other sovereign cloud endpoints aren’t supported.

Connect Azure Monitor

Grant Microsoft Entra admin consent

Open the consent link supplied by your Rootly account team and sign in as a Microsoft Entra administrator. Before accepting, compare the application ID on the consent details with the application ID Rootly supplied. If they don’t match, stop and contact your Rootly account team. Then review the publisher and requested access before granting consent for your tenant.Consent creates a Rootly service principal in your tenant. Rootly keeps the application credential in Rootly’s environment; you don’t create or send Rootly a client secret.Microsoft documents the tenant-wide admin consent flow and the admin consent protocol.

Collect the Azure scope

Use Azure Cloud Shell or an authenticated Azure CLI to collect the IDs you’ll enter in the Rootly connector form:

Collect Azure identifiers

AZURE_TENANT_ID='YOUR_TENANT_ID'

az account list --all \
  --query "[?tenantId=='${AZURE_TENANT_ID}' && state=='Enabled'].{subscriptionId:id, name:name}" \
  --output table

az account set --subscription YOUR_SELECTED_SUBSCRIPTION_ID

az monitor log-analytics workspace show \
  --resource-group YOUR_RESOURCE_GROUP \
  --workspace-name YOUR_WORKSPACE \
  --query '{workspaceId:customerId, resourceId:id}' \
  --output json

az resource show \
  --resource-group YOUR_RESOURCE_GROUP \
  --name YOUR_RESOURCE_NAME \
  --resource-type YOUR_RESOURCE_TYPE \
  --query id \
  --output tsv

az deployment group list \
  --resource-group YOUR_RESOURCE_GROUP \
  --query '[].id' \
  --output tsv

Repeat the az account set and resource-discovery commands for every selected subscription in the configured tenant.Keep these IDs for the self-serve Rootly form; you don’t need to send them to Rootly. Share them with your Rootly account team only if you request help validating a narrower RBAC assignment or troubleshooting setup.A workspace requires both identifiers. The workspace ID selects the Logs API endpoint; the full resource ID authorizes table and schema discovery through Azure Resource Manager.The v0 Deployments capability supports resource-group-scoped deployments. az deployment group list returns the required deployment IDs; subscription- and management-group-scoped deployment IDs aren’t supported.

Assign read-only Azure access

Find the Rootly service principal with the application ID supplied by your Rootly account team, then assign Monitoring Reader at the smallest scope that covers the selected resources:

Assign Monitoring Reader

ROOTLY_APP_ID='APPLICATION_ID_FROM_ROOTLY'
AZURE_SUBSCRIPTION_IDS=(
  'FIRST_SELECTED_SUBSCRIPTION_ID'
  'SECOND_SELECTED_SUBSCRIPTION_ID'
)

ROOTLY_SERVICE_PRINCIPAL_ID="$(
  az ad sp show --id "$ROOTLY_APP_ID" --query id --output tsv
)"

for AZURE_SUBSCRIPTION_ID in "${AZURE_SUBSCRIPTION_IDS[@]}"; do
  az role assignment create \
    --assignee-object-id "$ROOTLY_SERVICE_PRINCIPAL_ID" \
    --assignee-principal-type ServicePrincipal \
    --role 'Monitoring Reader' \
    --scope "/subscriptions/$AZURE_SUBSCRIPTION_ID"
done

az ad sp show reads the tenant’s service-principal directory through Microsoft Graph. If your signed-in account can’t perform that lookup, ask an Entra administrator to provide the Rootly enterprise application’s Object ID, then set ROOTLY_SERVICE_PRINCIPAL_ID to that value directly. The application ID and object ID are different.Subscription scope supports the complete connector, including subscription-level alerts and Resource Graph changes. For narrower resource-group or resource assignments, tell your Rootly account team which capabilities you need so the reduced scope can be tested before activation.Monitoring Reader grants read access without configuration changes. Don’t grant Monitoring Contributor. Microsoft documents the permissions in Roles, permissions, and security in Azure Monitor.

Choose capabilities

Select only the evidence sources your responders need. At least one capability must remain enabled; disabling a capability also removes its inventory from resource discovery.

Capability	Rootly AI can read
Logs	Authorized Log Analytics workspaces, live table metadata and schema, bounded Kusto Query Language (KQL) results, AKS workload evidence from Container Insights, and Application Insights operation traces
Metrics	Live metric definitions and bounded metric series for authorized resources
Alerts	Azure Monitor alert instances plus read-only alert-rule, action-group receiver-count, and alert-processing-rule configuration
Activity logs	Control-plane operations and callers for an authorized resource
Resource changes	Azure Resource Graph change history for authorized resources
Deployments	Operations and failures for explicitly allowlisted resource-group-scoped Azure Resource Manager deployment IDs
Resource health	Current Azure Resource Health plus subscription-scoped Service Health incidents, planned maintenance, and advisories
Diagnostic settings	Read-only routing configuration for logs and metrics

Each enabled capability needs a matching target: Logs needs at least one workspace, Alerts needs a subscription, and resource-scoped capabilities need an authorized workspace or resource. Rootly rejects configurations that would expose a tool with no usable target.Rootly AI can also correlate Activity Log and Resource Graph evidence in one exact pre-event window. It treats temporal proximity as evidence, not proof of causation.

Configure the connector in Rootly

In Rootly, go to AI & Agents → Connectors, find Azure Monitor (Native), and click Connect. Enter the scope you collected:

Microsoft Entra tenant ID — the tenant where you granted consent.
Authorized subscription IDs — one subscription UUID per line.
Log Analytics workspaces — one workspace UUID | full workspace resource ID pair per line.
Authorized Azure resource IDs — one full resource ID per line, including each resource-group-scoped deployment ID Rootly AI may inspect.
Data the agent may read — select only the capabilities responders need. At least one is required.

Click Connect. Rootly verifies that its enterprise application can mint a management token for the tenant before the connector is marked Connected. This check confirms tenant authorization; it doesn’t prove that every configured resource is readable. Azure RBAC is enforced again on each investigation request.Don’t enter or send Azure credentials or client secrets. To change the allowlist later, open the connected Azure Monitor (Native) card and click Configure. Saving re-verifies tenant authorization. Disconnect removes the connector from the Rootly team.

Run a smoke investigation

Ask Rootly AI a question that should produce known evidence, then compare the cited result with Azure:

“Which service had the highest failed-request rate in the last hour?”
“What changed on this resource in the 15 minutes before the first failure?”
“Did an Azure deployment operation fail before the latency increase?”
“Azure logs are missing for this resource. Where are its diagnostic settings routing telemetry?”
“Do Azure Monitor alerts, Resource Health, logs, and metrics agree about the impact?”
“Why didn’t this Azure alert page anyone? Check whether the rule, processing rules, and action-group delivery path are configured.”
“Trace this Application Insights operation ID across requests, dependencies, exceptions, and traces. Which service failed?”
“Are this AKS workload’s pods restarting, emitting warning events, or logging errors?”
“Could a Service Health incident or planned maintenance explain the symptoms?”

What Rootly AI Can Read

The connector exposes these read-only operations:

List the subscriptions, resources, and Log Analytics workspaces in the Rootly allowlist.
Discover live Log Analytics tables and retrieve the exact schema for one table.
Run KQL against one authorized workspace.
Discover metric definitions and query metric series for one authorized resource.
List Azure Monitor alert instances.
Inspect alert rules, referenced action groups, receiver counts, and alert processing rules without returning receiver addresses or webhook URLs.
List Activity Log events and Resource Graph changes.
Correlate Activity Log events and resource changes before an event.
List deployment operations for an explicitly authorized deployment ID.
Read current Resource Health.
List subscription-scoped Azure Service Health events.
Read diagnostic settings.
Inspect AKS pod state, restart counts, warning events, and container logs from Container Insights telemetry.
Trace one Application Insights operation across requests, dependencies, exceptions, and traces, prioritizing failures over routine trace messages.

Rootly AI discovers table columns and metric names before generating a query. This avoids relying on table shapes or metric definitions from another workspace or resource.

Scope and Safety Limits

Azure RBAC remains authoritative. Rootly adds the following limits before making a request:

Limit	Behavior
Resource scope	Every subscription, workspace, resource, and deployment must be in the Rootly allowlist
Query duration	Log, metric, activity, and change windows can’t exceed 24 hours
Log rows	A KQL result returns at most 500 rows
Log response	A Logs API response can’t exceed 1 MB
Metadata response	An Azure management response can’t exceed 5 MB
Metrics	One request can query up to 10 metric names
Cross-resource KQL	Cross-workspace, Resource Graph, Azure Data Explorer, cross-cluster/database, and external-data expressions are blocked
Transport	Azure requests use bounded connection and response timeouts

Rootly mints short-lived, audience-specific application tokens for the customer tenant and keeps each token only on the in-memory client handling that Azure request path. Tokens aren’t stored in the Azure connector record or a shared cache.

Interpreting Empty Results

An empty Azure response is evidence about the query, not proof that a service is healthy.

No alerts means Azure Monitor returned no matching alert instances for that filter and time range.
No Service Health events means Azure returned no matching subscription events in the selected window; it isn’t proof that the platform or every dependency was healthy.
No Activity Log events means no matching control-plane events were visible in that window.
No Resource Graph changes is inconclusive because Azure may omit or delay some change details.
No diagnostic settings means that resource has no resource-level diagnostic export. Telemetry can still arrive through another path, including Application Insights.
A table definition confirms that the table exists, not that it contains recent rows.
An unknown or absent Resource Health state is inconclusive.
No AKS workload rows can mean there was no matching activity, Container Insights wasn’t configured, or telemetry wasn’t available. This connector doesn’t query the live Kubernetes API.
No rows for an Application Insights operation ID can mean the ID or time window was wrong, sampling omitted telemetry, or the workspace didn’t receive that operation.

Use more than one signal when testing a hypothesis. Compare logs or metrics with alerts, health, activity, deployments, and change history where available.

Troubleshooting

Microsoft Entra authentication fails

Confirm that admin consent completed in the same tenant ID configured in Rootly. In Microsoft Entra admin center → Enterprise applications, find the Rootly application and confirm that it is enabled. Revoked consent, a disabled service principal, or a tenant ID copied from another directory prevents Rootly from saving the connector.

Azure returns an authorization error

Confirm that the role assignment targets the enterprise application’s service principal object ID, not the application ID. Check the assignment scope and allow time for Azure RBAC propagation. Microsoft notes that new Azure Monitor API role assignments can take time to become effective.

Logs fail but metrics work

Confirm that Monitoring Reader covers the Log Analytics workspace and that Rootly has both the workspace ID and its full resource ID. Microsoft documents Microsoft.OperationalInsights/workspaces/query/*/read as the permission required to query a workspace.

A workspace or resource is rejected

The requested ID isn’t in the Rootly allowlist, or its subscription isn’t configured. Copy the exact Azure Resource Manager ID returned by Azure CLI into the Azure Monitor (Native) connector’s allowlist. Resource IDs are case-insensitive, but every path segment must be present.

A query returns too much data

Narrow the time range, aggregate in KQL, or select fewer columns. Rootly rejects oversized responses and caps returned rows so an investigation can’t pull an unbounded telemetry set into model context.

Frequently Asked Questions

Do I need to host an Azure MCP server?

No. This connector calls Microsoft’s maintained Azure APIs directly. The separate Azure Resource Manager (MCP) connector uses Microsoft’s hosted endpoint. Neither connector requires you to host a server.

Does Rootly store my Azure client secret?

You don’t create a client secret for Rootly. Rootly operates its own Microsoft Entra application credential. The connector stores your tenant ID and explicit allowlists, then mints short-lived tokens for that tenant when Rootly AI needs Azure evidence.

Can Rootly AI change Azure resources?

No. The connector exposes read-only operations, and the supported setup uses Monitoring Reader. Rootly doesn’t expose deployment, configuration, alert-state, or diagnostic-setting write operations.

Is this the same as configuring an alert source?

No. Alert Sources send monitoring alerts into Rootly. The Azure Monitor AI connector lets Rootly AI retrieve Azure evidence during an investigation. Configure each surface separately.

Can I connect multiple Azure tenants?

One Azure tenant can be active per Rootly team. Use separate Rootly teams when investigations require isolated Azure tenants.

Azure Resource Manager (MCP)

Inventory Azure resources and inspect ARM deployment status through Microsoft’s hosted MCP endpoint.

Connectors Overview

Compare Rootly AI connectors and setup flows.

Alert Sources

Review the monitoring sources that send alerts into Rootly.

Data Privacy for Rootly AI

Review connector data handling and retention.

Getting Started

Alerts

On-Call

Incident Response

Retrospectives

Status Pages

Communications

Rootly AI

Workflows & Automation

Analytics

Configuration

Integrations

Administration

Resources & Help

Azure Monitor AI Connector

Overview

Before You Start

Connect Azure Monitor

What Rootly AI Can Read

Scope and Safety Limits

Interpreting Empty Results

Troubleshooting

Frequently Asked Questions

Azure Resource Manager (MCP)

Connectors Overview

Alert Sources

Data Privacy for Rootly AI

​Overview

​Before You Start

​Connect Azure Monitor

​What Rootly AI Can Read

​Scope and Safety Limits

​Interpreting Empty Results

​Troubleshooting

​Frequently Asked Questions

​Related Pages

Azure Resource Manager (MCP)

Connectors Overview

Alert Sources

Data Privacy for Rootly AI

Overview

Before You Start

Connect Azure Monitor

What Rootly AI Can Read

Scope and Safety Limits

Interpreting Empty Results

Troubleshooting

Frequently Asked Questions

Related Pages