Ingest OTLP data into Azure Monitor by using OTel Collector

Azure Monitor now supports native ingestion of OpenTelemetry Protocol (OTLP) signals. You can send telemetry data directly from OpenTelemetry-instrumented applications to Azure Monitor.

Overview

Azure Monitor can receive OTLP signals through three ingestion mechanisms:

• OpenTelemetry Collector - Send data directly to Azure Monitor cloud ingestion endpoints from any OTel Collector deployment.
• Azure Monitor Agent (AMA) - Ingest data from applications running on Azure virtual machines (VMs), Virtual Machine Scale Sets, or Azure Arc-enabled servers.
• Azure Kubernetes Service (AKS) add-on - Collect telemetry from containerized applications in AKS clusters. See Enable Azure Monitor OpenTelemetry for Kubernetes clusters for details.

This article covers the OTel Collector method of collecting OTLP signals.

Prerequisites

Set up OTLP data ingestion

You can configure OTLP data ingestion in Azure Monitor by using one of two approaches. The Application Insights-based approach is recommended for most scenarios as it automates resource creation and enables built-in troubleshooting experiences.

Option 1: Create an Application Insights resource with OTLP support (Recommended)

This method automatically provisions all required Azure resources and configures their relationships. You can use Application Insights for application performance monitoring, distributed tracing, and failure analysis.

1. In the Azure portal, create a new Application Insights resource.

2. On the Basics tab, set OTLP support to On.

   

3. Complete the resource creation process.

4. After deployment, go to the Overview page of your Application Insights resource.

5. In the OTLP Connection Info section, copy the following values:

   • The Data Collection Rule (DCR) resource ID
   • The endpoint URLs for traces, logs, and metrics (if you're using OpenTelemetry Collector)

   

Proceed to Configure your OpenTelemetry Collector.

Option 2: Manual resource orchestration

This option requires you to manually create and configure Data Collection Endpoints (DCE), Data Collection Rules (DCR), and destination workspaces. Use this approach when you need custom configurations or want to reuse existing resources.

Create destination workspaces

If you don't have existing workspaces, create the following resources in the same Azure region:

• Log Analytics workspace (LAW) - Stores log and trace data
• Azure Monitor workspace (AMW) - Stores metrics data

Record the resource IDs of both workspaces for later use.

(Optional) Create an Application Insights resource

To enable Application Insights troubleshooting experiences with your OTLP data:

1. Create an Application Insights resource in the same region as your workspaces.
2. Leave OTLP support set to Off to avoid creating duplicate resources.
3. Copy the Application Insights resource ID.

Deploy the Data Collection Endpoint and Rule

1. In the Azure portal, search for Deploy a custom template and select it.

2. Select Build your own template in the editor.

3. Copy the template content from the Azure Monitor Community repository.

4. Paste the template into the editor and update the parameters with your workspace resource IDs and (optionally) Application Insights resource ID.

   • In this example, the stream name from the community DCR template is used to create the endpoint URL used below. For metrics, you can optionally change the stream name in the DCR definition and match it when creating the DCE name. The stream name should start with Custom-Metrics- followed by a letter and then any combination of alphanumeric characters, -, and _.

5. Set the ___location to match your workspace region.

6. Review and create the deployment.

7. After deployment completes, navigate to the created DCR and copy its resource ID from the Overview page.

Configure your OpenTelemetry Collector

Configure Microsoft Entra authentication

The OpenTelemetry Collector requires Microsoft Entra authentication to send data to Azure Monitor.

For Azure VMs and Virtual Machine Scale Sets:

1. Enable system-assigned managed identity on your compute resource.

2. Assign the Monitoring Metrics Publisher role to the managed identity.

3. To use the system-assigned identity, leave the managed_identity section empty in your collector configuration:

   extensions:
     azure_auth:
       managed_identity: {}
       scopes:
         - https://monitor.azure.com/.default
   

   Note

   This example requires OpenTelemetry Collector version 0.148.0 or later. The azure_auth syntax isn't backward compatible with earlier versions.

For non-Azure environments:

Configure the Azure Authentication extension in your collector with an appropriate Microsoft Entra identity. Follow the examples in the Azure Authentication Extension README.

For workload identities, service principals, or other Microsoft Entra identities, provide the required identity details to authenticate.

Grant permissions to the Data Collection Rule

The identity your collector uses needs permission to write data to your DCR:

1. Go to your DCR in the Azure portal.

2. Select Access control (IAM) in the left navigation.

3. Select Add > Add role assignment.

   

4. Select Monitoring Metrics Publisher and select Next.

   

5. For Assign access to, select User, group, or service principal.

6. Select Select members and choose your application or managed identity.

   

7. Select Review + assign to save the role assignment.

Construct endpoint URLs

If you created your resources by using the Application Insights method, you already have the endpoint URLs from the OTLP Connection Info section. Skip to Update collector configuration.

For manually orchestrated resources, construct the endpoint URLs:

1. Go to your Data Collection Endpoint in the Azure portal.

2. Select JSON View from the Overview page.

3. Copy the logsIngestion and metricsIngestion endpoint values:

   "logsIngestion": {
       "endpoint": "https://<name>.<___location>-1.ingest.monitor.azure.com"
   },
   "metricsIngestion": {
       "endpoint": "https://<name>.<___location>-1.metrics.ingest.monitor.azure.com"
   }
   

4. Go to your Data Collection Rule and copy the Immutable ID from the Overview page.

5. Construct your endpoint URLs by using this pattern:

   Metrics endpoint:

   https://<metrics-dce-___domain>/datacollectionRules/<dcr-immutable-id>/streams/Custom-Metrics-Otel/otlp/v1/metrics
   

   • For metrics, you can optionally change the stream name in the Data Collection Rule (DCR) definition, but the stream name used in the DCR must exactly match the stream name used when constructing the Data Collection Endpoint (DCE) URL, and this match is case-sensitive. The stream name must start with Custom-Metrics-, followed by a letter, and then any combination of alphanumeric characters, hyphens (-), or underscores (_). If you change the stream name, you must update all references to the stream name in the DCR template and ensure the DCE URL uses the same value.

   Logs endpoint:

   https://<logs-dce-___domain>/datacollectionRules/<dcr-immutable-id>/streams/Microsoft-OTLP-Logs/otlp/v1/logs
   

   Traces endpoint:

   https://<logs-dce-___domain>/datacollectionRules/<dcr-immutable-id>/streams/Microsoft-OTLP-Traces/otlp/v1/traces
   

   Note

   The traces endpoint uses the logs DCE ___domain.

Update collector configuration

Configure your OpenTelemetry Collector with the authentication extension and Azure Monitor endpoints. Here's a sample configuration:

receivers:
  otlp:
    protocols:
      grpc:
        endpoint: localhost:4317
      http:
        endpoint: localhost:4318

processors:
  batch:

extensions:
  azure_auth:
    use_default: true
    scopes:
      - https://monitor.azure.com/.default

exporters:
  otlphttp/azuremonitor:
    traces_endpoint: "https://<logs-dce-___domain>/datacollectionRules/<dcr-immutable-id>/streams/<strong>Microsoft-OTLP-Traces</strong>/otlp/v1/traces"
    logs_endpoint: "https://<logs-dce-___domain>/datacollectionRules/<dcr-immutable-id>/streams/<strong>Microsoft-OTLP-Logs</strong>/otlp/v1/logs"
    metrics_endpoint: "https://<metrics-dce-___domain>/datacollectionRules/<dcr-immutable-id>/streams/microsoft-otelmetrics/otlp/v1/metrics"
    auth:
      authenticator: azure_auth

service:
  extensions:
    - azure_auth
  pipelines:
    traces:
      receivers: [otlp]
      processors: [batch]
      exporters: [otlphttp/azuremonitor]
    metrics:
      receivers: [otlp]
      processors: [batch]
      exporters: [otlphttp/azuremonitor]
    logs:
      receivers: [otlp]
      processors: [batch]
      exporters: [otlphttp/azuremonitor]

Next steps

• OpenTelemetry on Azure
• Monitor AKS with OpenTelemetry
• Dashboards with Grafana in Application Insights
• OpenTelemetry documentation