Azure for Cloud Insights

Introduction

Cloud Insights enables you to discover and monitor your cloud infrastructure. With Azure for Cloud Insights, you can display a catalog of cloud resources discovered through Inventory Monitoring with Inventory View, grouped by type, with configuration details and relationships.

Cloud Insights also provides visibility into traffic flows within and across virtual networks (VNets). It correlates flow data with cloud infrastructure changes and agent-based performance metrics to troubleshoot issues, optimize traffic, and ensure digital experience reliability. To explore how Cloud Insights enhances your visibility, see Cloud Insights.

To fully leverage Cloud Insights for Azure, you'll need to create two integrations:

1. Azure Inventory Monitoring: For more information, see Azure Inventory Monitoring Overview.

2. Azure Flow Logs Monitoring: For more information, see Azure Flow Logs Monitoring Overview.

At a minimum, Cloud Insights requires the Inventory Monitoring integration. Flow Logs Monitoring is not available without the Inventory Monitoring integration.

A general guide for setting up Azure Inventory Monitoring for Cloud Insights involves:

1. Identify the Azure subscriptions to monitor and create an app registration in Azure.

2. Assign the appropriate roles so the ThousandEyes integration can access your inventory data.

3. Create an Inventory Monitoring integration for the Azure subscriptions in ThousandEyes.

For specific instructions, see Creating the Azure Inventory Monitoring Integration for Cloud Insights.

For optimal results with Cloud Insights, also set up Flow Logs Monitoring. Overall steps include:

1. Configure your VNets to store flow logs in an Azure storage account.

2. Create an Azure Service Bus queue and configure the storage accounts to publish event notifications to this queue.

3. Assign the appropriate roles so the ThousandEyes integration can access your flow logs data. This allows ThousandEyes to poll the queue and access the flow log data from the relevant storage accounts.

4. Configure a Flow Logs Monitoring integration in ThousandEyes for log ingestion.

For specific instructions, see Creating the Azure Flow Logs Monitoring Integration for Cloud Insights.

Permissions Required for Azure Integrations

Azure Permissions for Cloud Insights Integrations

For both Inventory Monitoring and Flow Logs Monitoring, use an Azure service principal to securely integrate Azure services and APIs with ThousandEyes. An Azure service principal is a security identity within Microsoft Entra ID (formerly Azure Active Directory) used by applications, services, or automated tools to authenticate and access specific Azure resources in a non-interactive manner. Microsoft Entra ID serves as the identity provider for authenticating users and authorizing access to protected resources. The service principal acts as a programmatic equivalent of a user account, enabling secure, role-based access to Azure services without relying on human credentials. Service principals are useful for automation, CI/CD pipelines, and application integrations, providing fine-grained control over permissions.

To learn more about service principals, see Service Principal. To learn more about Microsoft Entra ID, see Microsoft Entra ID.

You must have the necessary Azure permissions to create a dedicated service principal for ThousandEyes Cloud Insights and to assign the appropriate built-in Azure roles.

In the Azure portal UI, service principals are called "App Registrations". For each Entra tenant, you can use a single app registration (or service principal) for both Inventory Monitoring and Flow Logs Monitoring integrations, or create a separate app registration for each. You can use the same app registration to monitor multiple subscriptions (see Cloud Insights Integrations for Multiple Microsoft Entra Tenants for more information). For a detailed step-by-step guide on creating an app registration for Cloud Insights, see Create a New App Registration in Azure.

For the Flow Logs Monitoring integration, permissions to create and manage the following resources within your Azure subscription are also needed:

• Azure Storage Account to create storage accounts for storing the flow logs. For more information, see Create a Storage Account.

• Azure Network Watcher to enable and configure VNet flow logs. For more information, see Network Watcher: VNet Flow Logs Overview.

• Azure Service Bus to create a dedicated queue for handling notifications when a new flow log is generated. For more information, see Azure Service Bus.

• Azure Event Grid to route flow log creation notifications to the Service Bus queue. For more information, see Event Grid Overview.

ThousandEyes Permissions for Azure Integration with Cloud Insights

To create the integrations, you must have an Organization Admin or Account Admin role in the ThousandEyes platform. For more information about ThousandEyes roles, see Role-Based Access, Explained.

How ThousandEyes Manages the Integrations

In ThousandEyes, organizations are divided into account groups. Cloud Insights integrations are specific to each account group. This means that an integration created in one account group is not shared with other groups. Each account group can configure integrations to monitor Azure subscriptions within your cloud network. ThousandEyes recommends creating a single Inventory Monitoring integration and a single Flow Logs Monitoring integration for each account group, even when monitoring multiple Azure subscriptions. If you require multiple Inventory Monitoring and Flow Logs Monitoring integrations within each account group, however, this is also supported (though for limitations, see Cloud Insights Integrations for Multiple Microsoft Entra Tenants).

The monitored subscriptions must be associated with the same Microsoft Entra tenant. If your subscriptions span multiple Microsoft Entra tenants, see Cloud Insights Integrations for Multiple Microsoft Entra Tenants.

Cloud Insights Integrations for Multiple Microsoft Entra Tenants

If your Azure subscriptions span multiple Microsoft Entra tenants, create at least one Inventory Monitoring integration for each such tenant, with a unique app registration per tenant. If creating separate app registrations for Flow Logs Monitoring per tenant, the same requirement applies. For Flow Logs Monitoring, you must also create only one Service Bus queue to serve each Microsoft Entra tenant, which can span multiple Azure subscriptions.

Cloud Insights automatically discovers the subscriptions in your Azure tenants, allowing multiple Azure subscriptions to be monitored using the same integration in each tenant. However, the same service principal (app registration) cannot be shared across multiple Inventory Monitoring integrations to prevent the same Azure subscription from being monitored by more than one integration. Similarly, a Service Bus queue cannot be shared across multiple ThousandEyes account groups.

For example, three different account groups within a ThousandEyes organization could each monitor one or more Azure subscriptions. Each monitored Azure subscription can span multiple regions. Account Group A can monitor two Azure subscriptions within Microsoft Entra Tenant A, Account Group B monitors one additional subscription within the same Microsoft Entra Tenant A, and Account Group C monitors another subscription in a completely separate Microsoft Entra tenant, Microsoft Entra Tenant B. In this case, one Inventory Monitoring integration would be configured for all subscriptions in Tenant A and a second Inventory Monitoring integration would be configured for the subscription in Tenant B.

For additional support with configuring Azure to work with your ThousandEyes account groups, reach out to your account manager.

Creating the Azure Inventory Monitoring Integration for Cloud Insights

These instructions cover setting up the integration using the Azure portal UI. For instructions on setting up the integration via command line (CLI), see CLI Instructions for Setting Up Azure Inventory Monitoring.

Azure Inventory Monitoring Overview

Cloud Insights Azure Inventory Monitoring collects inventory and configuration data from your Azure subscriptions over time. This data is used in Cloud Insights to:

• Automatically discover and catalog assets, maintaining an up-to-date inventory without manual effort. This eliminates the need for manual documentation by providing a time-correlated inventory of VNets, subnets, instances, and more, with metadata like resource IDs and regions. You can view your Azure network assets, including their types and locations by navigating to Cloud Insights > Inventory.

• Track configuration and operational events (e.g., subnet additions, network security group changes, backend targets changing to unhealthy). You can view historical changes and events under Cloud Insights > Inventory and Cloud Insights > Views.

• Correlate infrastructure changes with agent-based metrics (e.g., latency, response time) to pinpoint root causes quickly. You can time-correlate configuration events with performance data in Network & App Synthetics > Views.

• Track changes and flag anomalies, indicating possible unauthorized or misconfigured resources, ensuring compliance and secure configurations. Alert on unexpected changes (e.g., untagged VNets) and provide audit logs in the Inventory view for compliance reporting.

• Identify overprovisioned or underutilized cloud resources that can increase costs, enabling optimization of infrastructure for performance and cost-efficiency. Highlight resource attributes in the Inventory, guiding cost-saving adjustments.

• Provide end-to-end visibility across cloud infrastructures, integrating with agent data for comprehensive monitoring. Visualize cross-cloud dependencies in the Topology view under Network & App Synthetics > Views.

• Enrich flow log data (when the Flow Logs Monitoring integration is configured) by mapping raw VNet flow logs to the corresponding cloud resources identified by Cloud Insights Inventory Monitoring. This adds contextual details, such as resource IDs, types, and configurations, to the traffic flows, making it easier to understand and analyze network activity.

To create the Azure Inventory Monitoring integration:

1. Create a New App Registration in Azure

2. Create and Assign Roles to the Azure App Registration

3. Create the Inventory Monitoring Integration in ThousandEyes

Create an Azure App Registration for Inventory Monitoring

For the Inventory Monitoring integration, create an app registration (also known as a service principal) and assign a custom role to it. This role grants the service principal the necessary permissions to interact with Azure resources and perform the required monitoring tasks. Then, set the scope to the subscription you wish to monitor. If you have multiple subscriptions you want to monitor, consider setting the scope to the management group level, which aggregates the subscriptions (for instructions, see CLI Instructions for Management Groups).

For more information about assigning custom roles, see Azure custom roles. For more information about the permissions granted to ThousandEyes via the service principal, see Understand Azure role definitions: Actions and Azure permissions for Networking. These permissions are listed as "Actions" in step 3 of CLI Instructions for Setting Up Azure Inventory Monitoring.

Create a New App Registration in Azure

The following steps walk through creating the new app registration and noting the parameters needed for the Cloud Insights Inventory Monitoring integration. In ThousandEyes, these parameters are App ID, Tenant ID, and Password.

If you need more detailed instructions for setting up an Azure service principal, see How to Create a Service Principal.

1. In the Azure portal, select the App registrations service at the top of the screen. This takes you to a new screen that is titled "App registrations".

2. Click on New Registration (located in the top left corner). This takes you to a new screen that is titled "Register an application".

3. Name your app registration (for example, ThousandEyesCloudInsights) and click the Register button located at the bottom of the screen.

4. After the registration is complete, Azure will redirect you to an Overview page for the new app registration. Make a note of the Application (client) ID and Directory (tenant) ID values.

The Application (client) ID and Directory (tenant) ID values are needed for the ThousandEyes Cloud Insights integration.

1. On the left side menu of the screen, select Manage > Certificates & secrets. A screen appears with the title "Certificates & secrets".

2. Click on New client secret to create a new application password.

3. A side panel appears on the right. Enter a description into the "Description" field. Click the Add button at the bottom of side panel.

4. The side panel closes and the "Certificates & secrets" screen now shows the client secret you just created. Make a note of the contents of the Value field.

The Client secret Value is what you provide in the Password field for the ThousandEyes Cloud Insights integration.

Create and Assign Roles to the Azure App Registration

Once the app registration has been created in Azure, create and assign roles to the app registration that will grant permissions for interacting with Azure resources and performing monitoring tasks.

ThousandEyes Cloud Insights Inventory Monitoring requires a custom role. The following instructions walk through how to create and assign that role to the ThousandEyesCloudInsights app registration created in the previous section.

1. In the Azure portal, navigate to the Subscriptions service.

2. Select the subscription you want to monitor in Cloud Insights Inventory Monitoring. In the subscription overview page that appears, click Access control (IAM) from the menu on the side.

3. Click Create custom role. In the new window, select the JSON tab, then Edit.

4. Modify the JSON to match the example below, ensuring that all subscriptions you plan to monitor are included under assignableScopes. Note: if you want to scope the role to a management group, use "/providers/microsoft.management/managementGroups/{group_id}" as the assignable scope (see CLI Instructions for Management Groups for more information about scoping for management groups).

    {
     "properties": {
         "roleName": "thousandeyes-inventory-role",
         "description": "Cloud Insights Inventory Monitoring",
         "assignableScopes": [
             "/subscriptions/{subscription_id}"
         ],
         "permissions": [
             {
                 "actions": [
                         "*/read",
                         "microsoft.network/virtualnetworkgateways/getadvertisedroutes/action",
                         "microsoft.network/virtualnetworkgateways/getlearnedroutes/action",
                         "Microsoft.Network/virtualHubs/effectiveRoutes/action"
                 ],
                 "notActions": [],
                 "dataActions": [],
                 "notDataActions": []
             }
         ]
     }
 }

1. Click Next, then Create. The Review + create tab appears.

2. To assign the role you just created, go back to the Access control (IAM) screen from step 2.

3. Click Add role assignment. A screen opens with the title Add role assignment.

4. Search for the name of the custom role you created and select it from the list. Then click Next.

5. Click Select members. A side panel appears with the title Select members. Search for your application by name (for example, ThousandEyesCloudInsights), then select it from the list under the search box. The application is now listed under Selected members. Click the Select button at the bottom of the side panel.

6. Click Review + assign. A new screen appears with the title Add role assignment. The subscription ID from the previous screen is now added to the Scope field of the application. Click Review + assign again, to finalize the process.

Follow these steps for each subscription or management group you wish to monitor, ensuring that the custom role is assigned to the app registration. This grants the Cloud Insights Inventory Monitoring integration access to monitoring data from the subscriptions.

Create the Inventory Monitoring Integration in ThousandEyes

The integration for Azure Inventory Monitoring gives ThousandEyes secure access to your Azure subscription information and data. Before you begin, you'll need the App ID, Tenant ID, and Password for the app registration (service principal) you created in the section Create a New App Registration in Azure.

To find the App ID in the Azure portal, navigate to App registrations. Your application is listed under the All applications tab. You can find the App ID needed for ThousandEyes under the Application (client) ID column.

To find the Tenant ID in the Azure portal, using the search bar at the top of the page, search for "Tenant properties". You can find the Tenant ID needed for ThousandEyes in the Tenant ID field.

To find the Password in the Azure portal, navigate to Manage > Certificates and secrets. Select the Client secrets tab. Locate the row where the Description is the name of your custom role. You can find the Password needed for ThousandEyes under the Value column.

To set up Inventory Monitoring:

1. In the ThousandEyes app, go to Manage > Integrations.

2. Click + New Integration in the top right corner.

3. In the Add New Integration side panel that opens, select Microsoft Azure Cloud Services.

4. Name your integration. Give your integration a unique name. Duplicate names are not permitted.

5. Select Inventory Monitoring from the ThousandEyes Supported Services dropdown.

6. Fill in the App ID, Tenant ID, and Password for the app registration you created for this integration.

An app registration already in use by another Inventory Monitoring integration cannot be reused. This restriction ensures that each integration performs independent subscription discovery, preventing duplicate monitoring of the same subscription across multiple integrations.

1. Click Test.

2. If testing was successful, click Save. If testing was not successful, see Troubleshooting Azure Integration for Cloud Insights.

3. After saving successfully, the integrations list shows your new integration with a status of Pending. The status changes to Connected once the subscriptions have been fully onboarded.

A successful test of the Azure Inventory Monitoring integration

CLI Instructions for Setting Up Azure Inventory Monitoring

To set up the permissions in Azure needed for the ThousandEyes Inventory Monitoring integration from the command line, first make sure you have the Azure CLI (Command Line Interface) installed.

1. From the Azure CLI, log in to your Azure account: az login.

2. Display a list of subscriptions available in your account: az account list --output table. Make a note of the subcription_id for any subscriptions in the list you want to monitor with ThousandEyes Cloud Insights.

3. Create a custom role that grants the necessary permissions scoped to the subscriptions you want to monitor. For scoping to management groups, see CLI Instructions for Management Groups.

az role definition create --role-definition '{
 "Name": "thousandeyes-inventory-role",
 "Description": "Cloud Insights Inventory Monitoring",
 "Actions": [
   "*/read",
   "microsoft.network/virtualnetworkgateways/getadvertisedroutes/action",
   "microsoft.network/virtualnetworkgateways/getlearnedroutes/action",
   "Microsoft.Network/virtualHubs/effectiveRoutes/action"
 ],
 "AssignableScopes": [
   "/subscriptions/{subscription_id}"
 ]
}'

1. Create a service principal named ThousandEyesInventory and assign it the thousandeyes-inventory-role role you created in the previous step: az ad sp create-for-rbac -n "ThousandEyesInventory --role "thousandeyes-inventory-role" --scopes "/subscriptions/{subscription_id1}" "/subscriptions/{subscription_id2}" "/subscriptions/{subscription_id3}" Replace <subscription_id_n_> with the subscription ids from the previous step. Use spaces to delimit the subscription ids.

2. From the CLI output returned from the previous step, copy the values for the following fields: AppId, TenantId, Password. Enter these fields into the Azure integration form in ThousandEyes when prompted.

CLI Instructions for Management Groups

When creating your custom roles, you can assign scopes by subscription, as above, or by management group, the latter enabling you to manage multiple subscriptions at the same time. If you choose to scope by management group, follow these steps. Note the following limitations that Microsoft applies to using custom roles on management groups.

1. From the Azure CLI, log in to your Azure account: az login.

2. Display a list of management groups available in your account: az account management-group list --output table. Note that in further steps you need the group_id; in the output from this step, the group ID is found in the Name column, not the DisplayName column.

3. Create a custom role that grants the necessary permissions scoped to the relevant management group, replacing <group_id> with the group ID from step 2.

az role definition create --role-definition '{
 "Name": "thousandeyes-inventory-role",
 "Description": "Cloud Insights Inventory Monitoring",
 "Actions": [
   "*/read",
   "microsoft.network/virtualnetworkgateways/getadvertisedroutes/action",
   "microsoft.network/virtualnetworkgateways/getlearnedroutes/action",
   "Microsoft.Network/virtualHubs/effectiveRoutes/action"
 ],
 "AssignableScopes": [
   "/providers/microsoft.management/managementGroups/{group_id}"
 ]
}'

1. Create a service principal named ThousandEyesInventory and assign it the thousandeyes-inventory-role role you created in the previous step: az ad sp create-for-rbac -n "ThousandEyesInventory --role "thousandeyes-inventory-role" --scopes /providers/microsoft.management/managementGroups/{group_id}. Replace <group_id> with the group ID from step 2.

2. From the CLI output returned from the previous step, copy the values for the following fields: AppId, TenantId, Password. Enter these fields into the Azure integration form in ThousandEyes when prompted.

Creating the Azure Flow Logs Monitoring Integration for Cloud Insights

Azure Flow Logs Monitoring Overview

Cloud Insights Azure Flow Logs Monitoring tracks real traffic flows in your Azure network. The Flow Logs Monitoring integration gives ThousandEyes access to ingest flow logs from the specified storage accounts. This data is used, for example, to:

• Display outbound/inbound throughput for each entity in Cloud Insights > Views and Network & App Synthetics > Views.

• Highlight rejected traffic, visible in Cloud Insights > Views.

ThousandEyes Cloud Insights Flow Logs Monitoring consists of two steps:

1. ThousandEyes polls the designated Azure Service Bus queue for events triggering flow log creation.

2. ThousandEyes retrieves the flow log files (referenced in the event notification) directly from your Azure storage accounts.

ThousandEyes leverages your Inventory Monitoring integration to access Azure subscriptions for Cloud Insights monitoring. These subscriptions can contain VNets that generate traffic flow data via Azure VNet flow logs. You should aim to surface only traffic from subscriptions and VNets explicitly selected for monitoring through Inventory Monitoring integrations. Traffic from a VNet not monitored by an Inventory Monitoring integration may be ignored, filtered out, or classified as external traffic (see Unmonitored Subscription Warnings for more information).

The Azure storage account that stores the flow logs must:

• Reside in the same region as the virtual network.

• Reside in the same Azure subscription of the virtual network or in a subscription associated with the same Microsoft Entra tenant of the virtual network's subscription.

ThousandEyes recommends sending event notifications from storage accounts in any region or subscription to a single designated Azure Service Bus queue, which is shared across all subscriptions. You can use Event Grid System Topics to enable cross-subscription event notifications.

The Azure Service Bus queue serves as a central destination for event notifications. This can reside in an existing subscription or in a dedicated new subscription (this subscription does not need to be monitored). You can then use this Service Bus queue for integration with ThousandEyes Cloud Insights Flow Logs Monitoring.

The sections that follow provide instructions for setting up flow log storage in Azure and for granting ThousandEyes permission to read event logs.

To create the Azure Flow Logs Monitoring integration:

1. Configure Azure VNets to Store Flow Logs

2. Create an Azure Service Bus Queue for Notifications

3. Add the Storage Blob Data Reader Role to the Azure App Registration

4. Add the Service Bus Data Receiver Role to the Azure App Registration

5. Create the Azure Cloud Insights Flow Logs Integration in ThousandEyes

Configure Azure VNets to Store Flow Logs

Configure your Azure virtual networks (VNets) to store VNet flow logs in an Azure storage account. If this is already configured in your Azure subscriptions, you can skip this section.

1. Create an Azure storage account to store the flow logs. You must create a separate storage account for each region where you plan to store flow logs. For more information, see Create an Azure Storage Account.

2. Set your VNets to publish flow logs to the storage accounts. For more information, see Manage VNet Flow Logs.

Create an Azure Service Bus Queue for Notifications

The ThousandEyes Flow Logs Monitoring integration uses the Service Bus queue to poll for event notifications. This identifies the flow logs that can be downloaded from the associated storage account, indicated by the triggering event. By default, network public access is enabled. This is necessary for the Flow Logs Monitoring integration to function properly. Note that “public access” does not mean the storage account is open to everyone on the internet; it means that access is still restricted through proper authorization, which is handled via the service principal.

If you prefer not to allow access from all networks, you can choose Enabled from selected virtual networks and IP addresses instead. In this case, contact us so we can provide a list of IP addresses used to access your storage account. The specific IPs depend on the cluster hosting your account group.

In your Azure subscriptions, storage accounts publish event notifications to a designated Azure Service Bus queue. You can configure filters to control which events are published. A single Azure Service Bus queue can be used across multiple regions—incurring negligible cost due to the small event size—and multiple Azure subscriptions, provided they belong to the same Microsoft Entra tenant.

The ThousandEyes platform (located in the region where your account group resides) continuously polls the Service Bus queue for event notifications and then downloads the flow logs from the storage account associated with the event. Each Flow Logs Monitoring integration is uniquely associated with a specific Service Bus queue, meaning that sharing Service Bus queues across multiple integrations is not permitted. If you need to monitor the same virtual network across different account groups within ThousandEyes, you must create a separate Service Bus queue for each account group and configure EventGrid to route notifications to each queue.

Set up event notifications for log creation in a dedicated Azure Service Bus queue using Event Grid System Topics.

1. Create a Basic tier Azure Service Bus queue for handling notifications when a new flow log is generated. For more information, see Azure Service Bus Quickstart.

2. Create an Azure Event Grid System Topic for each storage account that contains flow logs that you wish to monitor. For more information, see Create, View, and Manage Event Grid System Topics.

3. In the system topic created in the previous step, add an event subscription with the Service Bus queue from the previous step as the endpoint. Optionally, use the Filter tab to refine the events being forwarded. For more information, see Event Grid: Handler Service Bus.

Modify the Azure App Registration for Flow Logs Monitoring

Once the VNet flow log storage and notifications have been configured, you can either modify the Inventory Monitoring app registration you are using for both integrations, or create a new app registration for Flow Logs Monitoring, according to the instructions below. This grants ThousandEyes permission to read event logs from: 1) the Azure Service Bus queue, and 2) the containers storing the associated flow logs.

To grant ThousandEyes access to read the event logs, assign the following built-in roles to the app registration you're using for the Flow Logs Monitoring integration:

• Storage Blob Data Reader: This role should be applied at the scope of each flow log container that the integration is expected to process. For more information, see Built-in Roles: Storage Blob Data Reader.

• Azure Service Bus Data Receiver: This role should be applied at the scope of the dedicated Service Bus queue created for this integration. For more information, see Built-in Roles: Azure Service Bus Data Receiver.

Add the Storage Blob Data Reader Role to the Azure App Registration

1. In the Azure portal, select the Storage Accounts service located at the top of the screen.

2. Select the storage account instance where your VNet flow logs are stored. In the search bar, type Containers and click on Containers.

3. Choose the container where your flow logs are stored. On the selected container, click on Access control (IAM).

4. Click the Add button. Select Add role assignment from the menu that appears. A screen opens with the title Add role assignment.

5. Search for the Storage Blob Data Reader role and click Next.

6. Click Select members. A side panel appears with the title Select members. Search for your application by name (for example, ThousandEyesCloudInsights), then select it from the list under the search box. The application is now listed under Selected members. Click the Select button at the bottom of the side panel.

7. Click Review + assign. A new screen appears with the title Add role assignment. The subscription ID from the previous screen is now added to the Scope field of the application. Click Review + assign again, to finalize the process.

8. Repeat this process for all containers storing flow logs that ThousandEyes is expected to process.

This grants the necessary permissions for the Cloud Insights Flow Logs Monitoring integration to access and read flow logs from the Azure storage account containers.

Add the Service Bus Data Receiver Role to the Azure App Registration

1. In the Azure portal, select the Service Bus service located at the top of the screen.

2. Choose the Service Bus instance you created for Flow Logs Monitoring. Scroll to the bottom of the screen and select the dedicated queue. On the selected queue, click Access control (IAM).

3. Click the Add button. Select Add role assignment from the menu that appears. A screen opens with the title Add role assignment.

4. Search for the Azure Service Bus Data Receiver role and click Next.

5. Click Select members. A side panel appears with the title Select members. Search for your application by name (for example, ThousandEyesCloudInsights), then select it from the list under the search box. The application is now listed under Selected members. Click the Select button at the bottom of the side panel.

6. Click Review + assign. A new screen appears with the title Add role assignment. The subscription ID from the previous screen is now added to the Scope field of the application. Click Review + assign again, to finalize the process.

This ensures that the Cloud Insights Flow Logs Monitoring integration has the necessary permissions to receive events from the Azure Service Bus queue.

Create the Azure Cloud Insights Flow Logs Integration in ThousandEyes

The integration for Azure Flow Logs Monitoring gives ThousandEyes secure access to your Azure flow logs.

Before you begin, you'll need the Service Bus queue URL. In the Azure Portal, search for Service Bus in the search bar and select the Service Bus instance created for the Flow Logs Monitoring integration. Then, navigate to the dedicated queue created for this purpose and copy the Queue URL.

To set up Flow Logs Monitoring:

1. In the ThousandEyes app, go to Manage > Integrations.

2. Click + New Integration in the top right corner.

3. In the Add New Integration side panel that opens, select Microsoft Azure Cloud Services.

4. Name your integration with a unique name (duplicate names are not permitted).

5. Select Flow Logs Monitoring from the ThousandEyes Supported Services dropdown.

6. Paste the URL of the Service Bus queue you created into the Service Bus Queue URL field.

7. Fill in the App ID, Tenant ID, and Password for the app registration you created for this integration (these are the same as for Inventory Monitoring if using the same app registration, but different if you created a new app registration for Flow Logs Monitoring).

8. Click Test.

If the Service Bus queue URL is used by another integration, testing will fail. Service bus queues cannot be shared between integrations.

1. If testing was successful, click Save. If testing was not successful, see Troubleshooting Azure Integration for Cloud Insights.

A successful test of the Azure Flow Logs Monitoring integration

Verify Your Azure Cloud Insights Integrations

After saving your integrations, ThousandEyes will begin monitoring the resources in your Azure subscriptions and, if configured, ingest VNet flow logs. To view the status of your integrations, navigate to Manage > Integrations. For detailed logs, navigate to the Integration Logs tab under Cloud Insights > Settings.

Upon saving, the integration status will initially be set to Pending. The status update can take a few minutes and requires you to refresh the page. If an issue prevents successful monitoring, the integration status will change to Failed. Clicking on the integration will display a detailed error message. If no errors occur, the integration status will change to Connected.

For more information about managing integrations, see Integrations.

For more information about viewing Cloud Insights integration logs, see Cloud Insights Settings: Integration Logs.

For more information about troubleshooting your Cloud Insights Azure integration, see Troubleshooting Azure Integration for Cloud Insights.