Secure Application Insights for client application

Question

Secure Application Insights for client application

Shigeru Nakagaki 120

Hello

I read this article. And I checked Azure API Management pricing.

We need VNet Integration. So, the tier has to be StandardV2. StandardV2 tier costs us over JPY 100,000 for a month. It's impossible to spend over JPY 100,000 just for an Application Insights proxy.

Are there any cost effective ways?

thanks

P.S. There is no Azure Application Insights in selection values of child tag. Application Insights is not Azure family?

Sai Prabhu Naveen Parimi 3,235 Reputation points Microsoft External Staff Moderator

2025-08-08T11:25:48.5433333+00:00
Hello @Shigeru Nakagaki

Thank you for bringing this up. it's a common concern that the StandardV2 tier of Azure API Management can be expensive, especially if your main goal is to secure Application Insights ingestion.

To help suggest more cost-effective options, could you clarify your specific need for VNet integration in this context? For instance, are you looking to:

Limit public access to Application Insights?

Securely route telemetry from a backend within a VNet?

Use Private Link to protect against data exfiltration?

Understanding this will help recommend the best solution for your situation.

Regarding your P.S. about Application Insights not being available in the selection values, Application Insights is categorized under Azure's monitoring tools and not listed directly under Azure services, which may be why it doesn’t appear in the expected selections.
Shigeru Nakagaki 120 Reputation points

2025-08-12T00:53:49.9733333+00:00

Hi, Sai

Yes, we have made Application Insights more secure by disabling data ingestion from the public internet and disabling local authentication.

So, we are using private link scope and private endpoint for application insights. Also we use RBAC.

thanks
Sai Prabhu Naveen Parimi 3,235 Reputation points Microsoft External Staff Moderator

2025-08-12T05:53:39.7733333+00:00
Hello @Shigeru Nakagaki

I see you’ve configured Application Insights to accept telemetry only through a private endpoint, with public ingestion disabled, local authentication off, and RBAC enabled. This setup means services must access the private endpoint via your VNet.

Currently, telemetry is sent through APIM, so APIM requires VNet integration to connect to Application Insights. This is why you’re considering Standard v2 or Premium tiers. However, if APIM is used solely for private connectivity, there are more budget-friendly alternatives:

Direct VNet access: If your workload is in the same VNet or a peered VNet as the Application Insights private endpoint, you can send telemetry directly without APIM.
Ref : https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-configure

Function App or App Service as a proxy: You can set up an Azure Function or App Service with VNet integration to forward telemetry to Application Insights, removing the need for APIM in this scenario.

Custom telemetry client: You could implement telemetry sending directly from your application over the private endpoint, eliminating the middle layer.

Note: If APIM isn’t required for API management tasks like policy enforcement or central routing, removing it from this process won’t affect functionality, just how traffic enters the VNet.

Hope this helps!!

Your answer

Sai Prabhu Naveen Parimi 3,235 Reputation points Microsoft External Staff Moderator

2025-08-08T11:25:48.5433333+00:00

Hello @Shigeru Nakagaki

Thank you for bringing this up. it's a common concern that the StandardV2 tier of Azure API Management can be expensive, especially if your main goal is to secure Application Insights ingestion.

To help suggest more cost-effective options, could you clarify your specific need for VNet integration in this context? For instance, are you looking to:

Limit public access to Application Insights?

Securely route telemetry from a backend within a VNet?

Use Private Link to protect against data exfiltration?

Understanding this will help recommend the best solution for your situation.

Regarding your P.S. about Application Insights not being available in the selection values, Application Insights is categorized under Azure's monitoring tools and not listed directly under Azure services, which may be why it doesn’t appear in the expected selections.
Shigeru Nakagaki 120 Reputation points

2025-08-12T00:53:49.9733333+00:00

Hi, Sai

Yes, we have made Application Insights more secure by disabling data ingestion from the public internet and disabling local authentication.

So, we are using private link scope and private endpoint for application insights. Also we use RBAC.

thanks
Sai Prabhu Naveen Parimi 3,235 Reputation points Microsoft External Staff Moderator

2025-08-12T05:53:39.7733333+00:00

Hello @Shigeru Nakagaki

I see you’ve configured Application Insights to accept telemetry only through a private endpoint, with public ingestion disabled, local authentication off, and RBAC enabled. This setup means services must access the private endpoint via your VNet.

Currently, telemetry is sent through APIM, so APIM requires VNet integration to connect to Application Insights. This is why you’re considering Standard v2 or Premium tiers. However, if APIM is used solely for private connectivity, there are more budget-friendly alternatives:

Direct VNet access: If your workload is in the same VNet or a peered VNet as the Application Insights private endpoint, you can send telemetry directly without APIM.
Ref : https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-configure

Function App or App Service as a proxy: You can set up an Azure Function or App Service with VNet integration to forward telemetry to Application Insights, removing the need for APIM in this scenario.

Custom telemetry client: You could implement telemetry sending directly from your application over the private endpoint, eliminating the middle layer.

Note: If APIM isn’t required for API management tasks like policy enforcement or central routing, removing it from this process won’t affect functionality, just how traffic enters the VNet.

Hope this helps!!

Share via

Secure Application Insights for client application

Your answer