{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/", "slug": "dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version", "url": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/" }, "title": "Match Prometheus remote-write authentication to the installed client version", "summary": "Do all supported Azure remote-write identity methods have the same minimum Prometheus version?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:28+00:00", "modified_at": "2026-09-10T01:20:45+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 231, "potentially_affected": "Self-managed Prometheus clients configured to remote-write directly to an Azure Monitor workspace.", "dse_recommendation": "Record the running Prometheus version and hosting environment before selecting its Azure authentication method.", "primary_source": { "name": "Connect self-managed Prometheus to Azure Monitor managed service for Prometheus - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/prometheus-remote-write", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Monitor’s direct Prometheus remote-write guide sets different minimum client versions: 2.45 for user-assigned managed identity, 2.48 for Microsoft Entra application authentication, 3.5.0 for system-assigned managed identity and 3.7.0 for workload identity. Supported hosting environments also differ by method; the documented workload-identity path lists AKS and Arc-enabled Kubernetes. Microsoft recommends direct configuration when replacing its remote-write sidecar. Microsoft Learn.

\n

Applicability

\n

Apply this compatibility check before changing authentication on a self-managed sender. A supported identity mechanism in Azure does not establish that an older Prometheus binary or every hosting environment supports that same path.

\n

DSE recommendation

\n

Record the running Prometheus version and hosting environment before selecting its Azure authentication method. Compare both with the documented requirements, then plan any needed client upgrade separately from the identity change. Preserve the current working configuration and agree how the team will identify a failed cutover. Do not substitute a credential-bearing method merely to avoid investigating a client-version mismatch.

\n

Verification

\n

Confirm the version of the actual running sender, not only a proposed image tag or a workstation’s command output. Check that its selected authentication configuration matches the approved environment and method. During a bounded cutover, inspect sender errors and verify expected new samples at the intended workspace. Treat successful identity creation and successful metric ingestion as separate results, and retain unresolved compatibility failures before expanding the change.

\n

Official references

\n

Microsoft Learn: Self-managed Prometheus remote write. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure Monitor’s direct Prometheus remote-write guide sets different minimum client versions: 2.45 for user-assigned managed identity, 2.48 for Microsoft Entra application authentication, 3.5.0 for system-assigned managed identity and 3.7.0 for workload identity. Supported hosting environments also differ by method; the documented workload-identity path lists AKS and Arc-enabled Kubernetes. Microsoft recommends direct configuration when replacing its remote-write sidecar. Microsoft Learn.\nApplicability\nApply this compatibility check before changing authentication on a self-managed sender. A supported identity mechanism in Azure does not establish that an older Prometheus binary or every hosting environment supports that same path.\nDSE recommendation\nRecord the running Prometheus version and hosting environment before selecting its Azure authentication method. Compare both with the documented requirements, then plan any needed client upgrade separately from the identity change. Preserve the current working configuration and agree how the team will identify a failed cutover. Do not substitute a credential-bearing method merely to avoid investigating a client-version mismatch.\nVerification\nConfirm the version of the actual running sender, not only a proposed image tag or a workstation’s command output. Check that its selected authentication configuration matches the approved environment and method. During a bounded cutover, inspect sender errors and verify expected new samples at the intended workspace. Treat successful identity creation and successful metric ingestion as separate results, and retain unresolved compatibility failures before expanding the change.\nOfficial references\nMicrosoft Learn: Self-managed Prometheus remote write. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Monitor’s direct Prometheus remote-write guide sets different minimum client versions: 2.45 for user-assigned managed identity, 2.48 for Microsoft Entra application authentication, 3.5.0 for system-assigned managed identity and 3.7.0 for workload identity. Supported hosting environments also differ by method; the documented workload-identity path lists AKS and Arc-enabled Kubernetes. Microsoft recommends direct configuration when replacing its remote-write sidecar. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/prometheus-remote-write).\n\n## Applicability\n\nApply this compatibility check before changing authentication on a self-managed sender. A supported identity mechanism in Azure does not establish that an older Prometheus binary or every hosting environment supports that same path.\n\n## DSE recommendation\n\nRecord the running Prometheus version and hosting environment before selecting its Azure authentication method. Compare both with the documented requirements, then plan any needed client upgrade separately from the identity change. Preserve the current working configuration and agree how the team will identify a failed cutover. Do not substitute a credential-bearing method merely to avoid investigating a client-version mismatch.\n\n## Verification\n\nConfirm the version of the actual running sender, not only a proposed image tag or a workstation’s command output. Check that its selected authentication configuration matches the approved environment and method. During a bounded cutover, inspect sender errors and verify expected new samples at the intended workspace. Treat successful identity creation and successful metric ingestion as separate results, and retain unresolved compatibility failures before expanding the change.\n\n## Official references\n\n[Microsoft Learn: Self-managed Prometheus remote write](https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/prometheus-remote-write). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/", "url": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Match Prometheus remote-write authentication to the installed client version", "item": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/", "url": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/", "headline": "Match Prometheus remote-write authentication to the installed client version", "description": "Do all supported Azure remote-write identity methods have the same minimum Prometheus version?", "abstract": "Do all supported Azure remote-write identity methods have the same minimum Prometheus version?", "articleBody": "Source facts\nAzure Monitor’s direct Prometheus remote-write guide sets different minimum client versions: 2.45 for user-assigned managed identity, 2.48 for Microsoft Entra application authentication, 3.5.0 for system-assigned managed identity and 3.7.0 for workload identity. Supported hosting environments also differ by method; the documented workload-identity path lists AKS and Arc-enabled Kubernetes. Microsoft recommends direct configuration when replacing its remote-write sidecar. Microsoft Learn.\nApplicability\nApply this compatibility check before changing authentication on a self-managed sender. A supported identity mechanism in Azure does not establish that an older Prometheus binary or every hosting environment supports that same path.\nDSE recommendation\nRecord the running Prometheus version and hosting environment before selecting its Azure authentication method. Compare both with the documented requirements, then plan any needed client upgrade separately from the identity change. Preserve the current working configuration and agree how the team will identify a failed cutover. Do not substitute a credential-bearing method merely to avoid investigating a client-version mismatch.\nVerification\nConfirm the version of the actual running sender, not only a proposed image tag or a workstation’s command output. Check that its selected authentication configuration matches the approved environment and method. During a bounded cutover, inspect sender errors and verify expected new samples at the intended workspace. Treat successful identity creation and successful metric ingestion as separate results, and retain unresolved compatibility failures before expanding the change.\nOfficial references\nMicrosoft Learn: Self-managed Prometheus remote write. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:28:28+00:00", "dateModified": "2026-09-10T01:20:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-208-match-prometheus-remote-write-authentication-to-the-installed-client-version/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Match Prometheus remote-write authentication to the installed client version" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 231, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Connect self-managed Prometheus to Azure Monitor managed service for Prometheus - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/prometheus-remote-write" } } ] } }