> ## Documentation Index > Fetch the complete documentation index at: /docs/llms.txt > Use this file to discover all available pages before exploring further. # Azure Monitor > Read Log Analytics, native metrics and Managed Prometheus through an app registration. Auto Monitors can create Azure alert rules and Prometheus rule groups. **1. Create an app registration** In Azure, create an app registration with a client secret, then assign it the roles below. **2. Connect** Go to **Connections**, click **Connect** next to Azure Monitor, and enter the tenant ID, application (client) ID, client secret, subscription ID, region, and Log Analytics workspace ID. **3. Choose sources (optional)** After connecting, the **Azure sources** panel lists every subscription, Log Analytics workspace and Azure Monitor workspace the app can see. Select the ones Ordyn may read. Each source shows whether your current roles already cover it, and the exact command to run if they don't. ## Permissions The app registration needs Log Analytics Reader and Monitoring Reader at subscription scope (workspace scope is not enough), plus Monitoring Contributor on the resource group for Ordyn's alert rules if Auto Monitors is on. Managed Prometheus uses Monitoring Data Reader on each selected Azure Monitor workspace. ### Infrastructure inventory List resources in every selected subscription. Granted by: `Monitoring Reader`. Permissions Ordyn uses: `Microsoft.Resources/subscriptions/resources/read`. ### Resource configuration Read resource configuration through ARM and Resource Graph. Granted by: `Monitoring Reader`. Permissions Ordyn uses: `*/read`. ### Metrics Read metric definitions and time series. Granted by: `Monitoring Reader`. Permissions Ordyn uses: `Microsoft.Insights/metricDefinitions/read`, `Microsoft.Insights/metrics/read`. ### Logs Query the primary and selected Log Analytics workspaces with KQL. | Granted by | Used for | | - | - | | `Monitoring Reader` | | | `Log Analytics Reader` | At subscription scope: Ordyn lists the subscription's workspaces to find yours. | Permissions Ordyn uses: `Microsoft.OperationalInsights/workspaces/query/read`. ### Infrastructure change history Read subscription Activity Log management events. Granted by: `Monitoring Reader`. Permissions Ordyn uses: `Microsoft.Insights/eventtypes/values/read`. ### Managed Prometheus metrics Only needed for selected Azure Monitor workspaces: run PromQL. Ordyn checks each workspace with a live read and asks for a data grant where Azure denies it. Granted by: `Monitoring Data Reader`. Permissions Ordyn uses: `Microsoft.Monitor/accounts/data/metrics/read`. ### Manage Prometheus alerts Only needed for Managed Prometheus: manage native rule groups in the alert resource group. Granted by: `Monitoring Contributor`. Permissions Ordyn uses: `Microsoft.AlertsManagement/prometheusRuleGroups/write`, `Microsoft.AlertsManagement/prometheusRuleGroups/delete`. ### Manage monitoring Manage Ordyn's alert rules and the action group that delivers alerts to Ordyn, in the resource group you choose. | Granted by | Used for | | - | - | | `Monitoring Contributor` | At the resource group where Ordyn's alert rules should live. | Permissions Ordyn uses: `Microsoft.Insights/metricAlerts/write`, `Microsoft.Insights/metricAlerts/delete`, `Microsoft.Insights/scheduledQueryRules/write`, `Microsoft.Insights/scheduledQueryRules/delete`, `Microsoft.Insights/actionGroups/write`. * The two reader roles must be at subscription scope: Ordyn lists the subscription's workspaces and reads alert rules across the subscription. Only the write role is narrowed to a resource group. * Managed Prometheus is optional. Apply its workspace data grant once for each selected Azure Monitor workspace. The Azure sources panel checks actual PromQL access and shows source-specific grant commands when needed. ### How to grant > **Assign the roles (Azure CLI)** > > ```bash theme={null} > az role assignment create --assignee --role "Log Analytics Reader" --scope "/subscriptions/" && > az role assignment create --assignee --role "Monitoring Reader" --scope "/subscriptions/" && > az role assignment create --assignee --role "Monitoring Contributor" --scope "/subscriptions//resourceGroups/" > ``` > **Grant a selected Prometheus workspace** > > ```bash theme={null} > az role assignment create --assignee --role "Monitoring Data Reader" --scope "" > ``` Replace the values in angle brackets. Permission catalog version `2026-10-16.1`. See [permission changes](/reference/permission-changes). ## Selected sources The **Azure sources** panel checks each selected workspace and shows a grant command for its exact scope when access is missing. Prometheus is optional; select its workspaces after connecting, then verify their PromQL access. Source selection controls discovery and direct query targets. Cross-workspace KQL and saved functions can still read resources allowed by the connection's Azure roles. Use Azure role assignments to enforce data access boundaries. Ordyn requests tokens for `https://prometheus.monitor.azure.com` with the same client secret. Workspaces with public network access disabled also require a network path from Ordyn; role grants alone do not make them reachable. ## What Ordyn reads * Log Analytics tables through KQL: application logs, diagnostic logs, and resource logs from App Service, Functions, AKS, and other services. * Metrics and existing alert rules through Monitoring Reader, in every selected subscription. * Managed Prometheus series through PromQL, such as AKS container metrics or Temporal task queue backlog, from each selected Azure Monitor workspace. Auto Monitors can create Prometheus rule groups for signals that live in Managed Prometheus. Each group is created in the Ordyn resource group, evaluated by Azure against the selected workspace, and notifies Ordyn through the same action group as other alert rules. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.