Implement generative AI and agentic solutions 2.3 Optimize and operationalize generative AI systems

Application Insights is connected to a Foundry project and traces are arriving.

Study guide skill: Set up observability by implementing tracing, token analytics, safety signals, and latency breakdowns

Question B6-026

Application Insights is connected to a Foundry project and traces are arriving. One developer gets authorization errors when viewing or querying the agent's telemetry, and the underlying Log Analytics tables are protected. What should you do?

Select one answer.

  • A Redact sensitive data before it enters telemetry
  • B Reinstall and reconfigure the client-side tracing instrumentation packages
  • C Assign the Log Analytics Reader role on the connected resource, and also assign Privileged Monitoring Data Reader because the tables are protected ✓ Correct answer
  • D Reconnect Application Insights, generate new agent traffic, and refresh after a few minutes

Answer: C

Authorization errors when querying or viewing telemetry come from missing RBAC permissions: assign Log Analytics Reader for log queries, and Privileged Monitoring Data Reader too when the tables are protected. Reconnecting and generating traffic is the fix when no traces appear at all, and reinstalling instrumentation is for client-side traces that don't appear. Redaction addresses sensitive content in traces, not access.

Deep dive

How it works

Foundry stores agent traces in the Application Insights resource connected to your project, backed by Log Analytics. Seeing that telemetry is governed by Azure RBAC on those resources, separately from Foundry project access.

The tracing setup page's troubleshooting table matches the symptom exactly. Authorization errors when you query or view telemetry are caused by missing RBAC permissions on Application Insights or Log Analytics. The fix:

  1. Confirm access in Access control (IAM) for the connected resources.
  2. Assign Log Analytics Reader for log queries.
  3. If the tables are protected, also assign Privileged Monitoring Data Reader.

The prerequisites say the same: Log Analytics Reader on the connected Application Insights resource is required to query telemetry.

The other options, and when you'd use them

  • Redact sensitive data: That's the fix when prompts, tool arguments or outputs put sensitive data in traces. It doesn't grant anyone access.
  • Reinstall instrumentation packages: That's for client-side traces that don't appear because instrumentation isn't installed or configured. Here traces arrive; one user just can't read them.
  • Reconnect Application Insights and generate traffic: That's the fix when you don't see any traces at all. Again, traces are arriving.

Exam tip

Traces exist but one user gets authorization errors = RBAC: Log Analytics Reader, plus Privileged Monitoring Data Reader for protected tables.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Generative AI & agents questions · AI-103 study guide

Thanks for your feedback!