Setting up Azure Monitor Dashboard with Grafana Issues

Hello Ysabel,

You are seeing two related errors when setting up Grafana dashboard template for VM with azure as data source

• 400 Bad Request: Invalid SubscriptionID / malformed subscription identifier
• "EvolvedSecurityTokenService' access token is from the wrong issuer

1. Malformed subscription identifier: This issue occurs because the subscription identifier provided in the data source configuration is invalid or malformed. Often , this issue is that instead of specifying a proper azure subscription id, a resource  group or wrong string like resourceGroup  has been mistakenly entered where the subscription id expected.

/subscriptions/${subscriptionId}/resourceGroups/${resourceGroup}/providers/Microsoft.Compute/virtualMachines/${vmName}
 

•  Ensure that Grafana azure monitor data source settings you correctly enter the subscription ID, not the resource group or other identifier
• Check the data source setting for the miss configuration fields.
• If you are using managed identity or app registration for authentication, make sure the identity has proper access to the subscription and relevant resource

2. Access token is from the wrong issuer: this error indicates a mismatch in the azure active directory(AAD) tenant context between where the toke is issued and the tenant associated with the Azure subscription; it often happens if:

1. If the subscription has been transferred to different tenant recently and token being issue is from old tenant
2. The authentication setup in Grafana references a tenant that doesn’t match the subscription tenant.

 To fix this:

• Confirm in azure that subscription belongs to the tenant specified in your Grafana data source configuration
• Check the tent id in your Grafana azure monitor data source matched the exactly  the tenant ID owning the subscription in azure
• If you recently transferred subscriptions between tenant, allow some time  for propagation or re-authentication
• Reconfigure the azure service principle or managed identity used by Grafana to authenticate against the correct tenant.

Also, in the azure portal, ensure the App registration or managed identity used for Grafana has the appropriate permission at the subscription level.

Please let me know if you face any challenge here, I can help you to resolve this issue further.