Back to Checks
azure

Subscription has at least one Application Insights resource configured

appinsights_ensure_is_configured
Service: appinsightsSeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.insights/components

Azure subscription contains at least one Application Insights resource collecting application telemetry (metrics, traces, logs) for monitored workloads.

The check determines whether telemetry collection exists at the subscription level, indicating that application monitoring is configured.

Prowler logoProwlerprowler-provider-azure

Risk

If Application Insights is missing, applications run with reduced observability, limiting detection of anomalies and attacks.

This undermines integrity and accountability (fewer traces), degrades availability by slowing troubleshooting, and increases exposure to undetected data exfiltration or injection at the app layer.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks appinsights_ensure_is_configured

Recommendation

Deploy Application Insights for all critical workloads and centralize data in a Log Analytics workspace. Configure actionable alerts and dashboards, enforce least privilege on telemetry, and set retention/export policies. Use private connectivity and appropriate sampling, and integrate with SIEM for defense in depth.

Remediation

CLI

az monitor app-insights component create --app <APP_NAME> --resource-group <RESOURCE_GROUP> --location <LOCATION> --application-type web --subscription <SUBSCRIPTION_ID>

Terraform

# Critical: This resource creates an Application Insights component to satisfy the check
resource "azurerm_application_insights" "main" {
  name                = "<example_resource_name>"
  location            = "<location>"
  resource_group_name = "<example_resource_name>"
  application_type    = "web" # Critical: ensures creation of the component
}

NativeIaC

// Create a minimal Application Insights resource
resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
  name: '<example_resource_name>'
  location: '<location>'
  properties: {
    Application_Type: 'web' // Critical: creates the App Insights component required to pass the check
  }
}

Other

1In the Azure portal, go to Azure Monitor > Application Insights
2Click Create
3Select a Subscription and Resource group
4Enter a Name and choose a Region
5Click Review + create, then Create
6Verify the resource appears under Application Insights in the selected subscription

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.appinsights.appinsights_client import (
    appinsights_client,
)


class appinsights_ensure_is_configured(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for subscription_id, components in appinsights_client.components.items():
            subscription_name = appinsights_client.subscriptions.get(
                subscription_id, subscription_id
            )
            report = Check_Report_Azure(metadata=self.metadata(), resource={})
            report.status = "PASS"
            report.subscription = subscription_id
            report.resource_name = subscription_id
            report.resource_id = f"/subscriptions/{subscription_id}"
            report.status_extended = f"There is at least one AppInsight configured in subscription {subscription_name} ({subscription_id})."

            if len(components) < 1:
                report.status = "FAIL"
                report.status_extended = f"There are no AppInsight configured in subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References