{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/", "slug": "dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication", "url": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/" }, "title": "Check browser telemetry before disabling local Application Insights authentication", "summary": "The browser JavaScript SDK has a different authentication support boundary.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:16+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 213, "potentially_affected": "Use this review for an Application Insights resource that receives browser JavaScript telemetry as well as other application data. Identify every sending client and its instrumentation method before changing the resource's authentication policy. Do not assume that a working server-side identity validates the browser path.", "dse_recommendation": "DSE recommends documenting a supported ingestion plan for each client before disabling local authentication.", "primary_source": { "name": "Microsoft Entra Authentication for Application Insights - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/azure-ad-authentication", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft lists the Application Insights JavaScript SDK among the unsupported scenarios for Microsoft Entra authentication. The same guidance describes disabling local authentication so the resource accepts telemetry authenticated with managed identities or Microsoft Entra ID. Those two facts require a client-by-client migration review. Microsoft Learn.

\n

Applicability

\n

Use this review for an Application Insights resource that receives browser JavaScript telemetry as well as other application data. Identify every sending client and its instrumentation method before changing the resource’s authentication policy. Do not assume that a working server-side identity validates the browser path.

\n

DSE recommendation

\n

DSE recommends documenting a supported ingestion plan for each client before disabling local authentication. Have the application owner explain how required browser observations will remain available. Test the complete plan in an isolated resource and retain the previous configuration. Do not add credentials to browser code to imitate a server-side authentication pattern.

\n

Verification

\n

Generate approved browser and server interactions and inspect their telemetry separately in the intended test resource. Compare the client inventory with the records that arrive under the proposed authentication settings. Hold the production change if a required client has no verified supported path. Preserve the tested SDK versions and per-client results with the migration decision.

\n

Official references

\n

Microsoft Learn: Microsoft Entra Authentication for Application Insights.

", "content_text": "Source facts\nMicrosoft lists the Application Insights JavaScript SDK among the unsupported scenarios for Microsoft Entra authentication. The same guidance describes disabling local authentication so the resource accepts telemetry authenticated with managed identities or Microsoft Entra ID. Those two facts require a client-by-client migration review. Microsoft Learn.\nApplicability\nUse this review for an Application Insights resource that receives browser JavaScript telemetry as well as other application data. Identify every sending client and its instrumentation method before changing the resource’s authentication policy. Do not assume that a working server-side identity validates the browser path.\nDSE recommendation\nDSE recommends documenting a supported ingestion plan for each client before disabling local authentication. Have the application owner explain how required browser observations will remain available. Test the complete plan in an isolated resource and retain the previous configuration. Do not add credentials to browser code to imitate a server-side authentication pattern.\nVerification\nGenerate approved browser and server interactions and inspect their telemetry separately in the intended test resource. Compare the client inventory with the records that arrive under the proposed authentication settings. Hold the production change if a required client has no verified supported path. Preserve the tested SDK versions and per-client results with the migration decision.\nOfficial references\nMicrosoft Learn: Microsoft Entra Authentication for Application Insights.", "content_markdown": "## Source facts\n\nMicrosoft lists the Application Insights JavaScript SDK among the unsupported scenarios for Microsoft Entra authentication. The same guidance describes disabling local authentication so the resource accepts telemetry authenticated with managed identities or Microsoft Entra ID. Those two facts require a client-by-client migration review. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/app/azure-ad-authentication).\n\n## Applicability\n\nUse this review for an Application Insights resource that receives browser JavaScript telemetry as well as other application data. Identify every sending client and its instrumentation method before changing the resource’s authentication policy. Do not assume that a working server-side identity validates the browser path.\n\n## DSE recommendation\n\nDSE recommends documenting a supported ingestion plan for each client before disabling local authentication. Have the application owner explain how required browser observations will remain available. Test the complete plan in an isolated resource and retain the previous configuration. Do not add credentials to browser code to imitate a server-side authentication pattern.\n\n## Verification\n\nGenerate approved browser and server interactions and inspect their telemetry separately in the intended test resource. Compare the client inventory with the records that arrive under the proposed authentication settings. Hold the production change if a required client has no verified supported path. Preserve the tested SDK versions and per-client results with the migration decision.\n\n## Official references\n\n[Microsoft Learn: Microsoft Entra Authentication for Application Insights](https://learn.microsoft.com/en-us/azure/azure-monitor/app/azure-ad-authentication)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/", "url": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check browser telemetry before disabling local Application Insights authentication", "item": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/", "url": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/", "headline": "Check browser telemetry before disabling local Application Insights authentication", "description": "The browser JavaScript SDK has a different authentication support boundary.", "abstract": "The browser JavaScript SDK has a different authentication support boundary.", "articleBody": "Source facts\nMicrosoft lists the Application Insights JavaScript SDK among the unsupported scenarios for Microsoft Entra authentication. The same guidance describes disabling local authentication so the resource accepts telemetry authenticated with managed identities or Microsoft Entra ID. Those two facts require a client-by-client migration review. Microsoft Learn.\nApplicability\nUse this review for an Application Insights resource that receives browser JavaScript telemetry as well as other application data. Identify every sending client and its instrumentation method before changing the resource’s authentication policy. Do not assume that a working server-side identity validates the browser path.\nDSE recommendation\nDSE recommends documenting a supported ingestion plan for each client before disabling local authentication. Have the application owner explain how required browser observations will remain available. Test the complete plan in an isolated resource and retain the previous configuration. Do not add credentials to browser code to imitate a server-side authentication pattern.\nVerification\nGenerate approved browser and server interactions and inspect their telemetry separately in the intended test resource. Compare the client inventory with the records that arrive under the proposed authentication settings. Hold the production change if a required client has no verified supported path. Preserve the tested SDK versions and per-client results with the migration decision.\nOfficial references\nMicrosoft Learn: Microsoft Entra Authentication for Application Insights.", "datePublished": "2026-09-17T16:32:16+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-164-check-browser-telemetry-before-disabling-local-application-insights-authentication/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check browser telemetry before disabling local Application Insights authentication" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 213, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Microsoft Entra Authentication for Application Insights - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/azure-ad-authentication" } } ] } }