Better Stack offers a rich integration with Azure, allowing you to easily monitor your cloud infrastructure.

Deploy our prepared Azure Resource Manager templates to your subscription or individual resource groups to get detailed observability for your Azure tenant.

This integration provides:

• Forwarding of Azure subscription activity logs (if deployed at subscription level).
• Automatic scraping of selected Azure Monitor metrics.
• Forwarding of selected resource logs.
• Integration with Application Insights to forward additional telemetry to Better Stack.

You can integrate your Azure tenant at either subscription level (default), which allows Better Stack to forward activity logs for the subscription and grants access to all resource groups, or resource group level; this scopes all permissions for Better Stack to the selected resource group, but limits the data we can forward.

Multiple Better Stack sources for a single Azure tenant are supported if you want to have varying retention periods or control access to different sets of data.

1. Create a source

Create a new Azure Source in Better Stack.

2. Connect your Azure tenant

You must provide admin consent to the Better Stack application; this goes through the regular Microsoft consent flow, and creates a Service Principal in your tenant, without storing any long-lived credentials there.

Provide a name for the Azure tenant that you can use to label the connected tenant.

3. Deploy the Azure ARM template

Choose your deployment mode; we recommend the default 'Subscription' mode unless you have security or permission restrictions that prevent you deploying at the subscription level.

Clicking "Deploy to Azure" will open the Azure Portal with a pre-loaded deployment template. You will need to pick a resource group to deploy the Better Stack components in. We recommend a new one, named for the region, for example "rg-betterstack-uksouth".

Once the deployment has completed, which can take up to 5 minutes, the detected subscription (or resource group) will appear on your Better Stack source page.

You can see details of exactly what gets deployed, including the templates and function code, at https://github.com/BetterStackHQ/azure

4. Select resource groups

You can choose any of the subscriptions and resource groups accessible via the deployments you've provided, or click select-all to also pick up new resource groups.

Changing the selected resource groups modifies the set of metrics and resources displayed below.

5. Select metrics

The listed metrics are all retrieved from the known metrics for your resources, from Azure Monitor. You can choose individual metrics, groups of metrics by namespace or all metrics. Selecting a whole group (or all) will scrape any future available metrics that get added as you deploy more resources.

6. Select logs

Better Stack can automatically configure your resources' Diagnostic Settings to forward logs to Better Stack. You can choose individual resources, groups or all resources.

Selecting an entire group or all resources, will automatically start collecting logs for those resources when they are created in your tenant.

You can only collect logs for resources in the regions you have deployed into. See Deploying to more regions for details.

Application Insights

When you have linked Azure Application Insights components in your tenant, Better Stack can pick up custom metrics and application logs sent to Application Insights and forward them to Better Stack.

In the source configuration page, you can choose whether to collect this additional data and send it to Better Stack.

Manual configuration - additional data

If there is an Application Insights component or any other resource we have not been able to detect or configure for whatever reason, you can manually configure log forwarding by going to the resource's page in the Azure portal, going to Monitoring -> Diagnostic settings and adding a new diagnostic setting that forwards selected categories to an existing Better Stack Event Hub in the same region.

Do not send resource AllMetrics categories in this way, as they will duplicate the metrics already being scraped by Better Stack via Azure Monitor.

Collecting logs from virtual machines

Virtual machine resources do not output their OS logs to Diagnostic Settings; if you want to monitor your virtual machine logs and guest-level metrics, we recommend deploying a Better Stack collector.

Deploying to more regions

When you first deploy the Better Stack integration, metrics can be fetched from all regions you have resources in; however, in order to forward logs from those resources there must be a deployed Better Stack Event Hub and Function in that region. In the Better Stack source page, you can click "Deploy to another region" to re-run the integration deploy for a single new region, or if not using the subscription deployment, deploy to a resource group in the new region.

Removing the integration

To remove the integration from the Azure Portal:

1. If deployed at the subscription level, visit the Subscription 'assigned roles' and remove any Better Stack resource role assignments.
2. Delete all Better Stack resources from your resource group/subscription. If you created a resource group for Better Stack, delete the entire resource group.
3. Repeat for each region/resource group you deployed.
4. Finally, if you need to remove consent fully, go to Enterprise Applications in Microsoft Entra and revoke admin consent.

Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏