Validate the specific availability test beyond its shared source addresses

Source facts

Application Insights availability tests use shared source addresses. Microsoft warns that an address-only firewall allowance can also admit traffic from other tests. The ApplicationInsightsAvailability service tag covers all availability tests, not an individual customer’s test. Microsoft Learn.

For Standard tests, the guidance adds an identifying X-Customer-InstanceId header and requires the receiving service to check its configured value. Standard tests still need network reachability; the documented alternative for nonpublic endpoints is an internal health signal with log or metric alerting. Public test enablement also requires resolvable public DNS. Microsoft Learn.

Applicability

Review Application Insights Standard availability tests against firewall-protected web endpoints. Treat the network allowance and the receiving application’s identifier check as separate controls. This article does not propose exposing a private endpoint merely to obtain an external test result.

DSE recommendation

DSE recommends recording the intended test identifier with the endpoint owner and verifying that the service actually enforces it. Keep the allowance limited to the approved endpoint and test purpose. If the service cannot accept an appropriate external test path, choose an internal observation design instead. Do not treat a service-tag match as proof that a request belongs to your configured test.

Verification

Use an approved test endpoint to compare the configured identifier with missing and incorrect values. Confirm the intended request succeeds and the unwanted cases are rejected as designed. Review the endpoint’s request evidence, not just the test’s green status. Retain the identifier-validation decision and network scope together for subsequent changes.

Official references

Microsoft Learn: Application Insights availability tests.