Skip to content

dotnetup: Use connection string rather than an ikey - #55126

Merged
dsplaisted merged 1 commit into
release/dnupfrom
nagilson-dotnetup-telemetry-uses-connection-string-over-ikey
Jul 3, 2026
Merged

dsplaisted merged 1 commit into
release/dnupfrom
nagilson-dotnetup-telemetry-uses-connection-string-over-ikey

Conversation

@nagilson

@nagilson nagilson commented Jul 2, 2026

Copy link
Copy Markdown
Member

Instrumentation keys are an old mechanism which are replaced by connection strings.

https://learn.microsoft.com/en-us/azure/azure-monitor/app/connection-strings https://learn.microsoft.com/en-us/azure/azure-monitor/app/migrate-from-instrumentation-keys-to-connection-strings#whats-the-difference-between-global-and-regional-ingestion

Motivation

In #54733, I noted using curl that hitting the ingestion endpoint via the likely added 50-60ms on a median call (for me, not the median user). But after more testing, I found this actually shaves 198ms median off the time to POST telemetry which means more data will get through and it will take less time to flush.
(The curl demo did not actually test the e2e workflow of sending telemetry and using the connection string.)

Additionally, there is another win in that data will not be lost as it is with using an instrumentation key, see below.

Background

This documentation shown above outlines the following:

  1. App Insights resources may be sharded regionally or ingested into one final bucket. If they are ingested into one bucket, there is only one ingestion endpoint. A global redirect may use different regional endpoints may exist to route an instrumentation key to the ingestion endpoint but the ingestion endpoint is not globally distributed.
  2. Data sent via ikeys might be lost - this is what we have observed. Now, the docs don't give a reason but we can assume it's because the redirects may fail, or servers may be transient, etc.

Empirically:

I noticed that for one and done environments, hitting the end point that resolves from the instrumentation key using curl for the first time would often fail, returning the following: no data of the requested type response.

I attempted to hit various endpoints and observed that they all finally redirected to the same place. (and that we only have southcentralus as a viable endpoint)

Endpoints hit to redirect from the Ikey:
URL Result
https://dc.services.visualstudio.com/v2.1/track 307 to https://southcentralus-0.in.applicationinsights.azure.com/v2.1/track https://dc.applicationinsights.azure.com/v2.1/track same 307 target https://dc.applicationinsights.microsoft.com/v2.1/track same 307 target

(this comes from https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/monitor/Azure.Monitor.OpenTelemetry.Exporter/src/Internals/ConnectionString/Constants.cs)

southcentralus as the only viable endpoint:
URL Result
southcentralus-0.in.applicationinsights.azure.com 200, itemsAccepted: 1 southcentralus.in.applicationinsights.azure.com 200, itemsAccepted: 1 centralus-2.in.applicationinsights.azure.com 400, Invalid instrumentation key westus2-0.in.applicationinsights.azure.com 400, Invalid instrumentation key japaneast-0.in.applicationinsights.azure.com 400, Invalid instrumentation key

Further evidence:

Aspire and other repos already do this, https://github.com/microsoft/aspire/blob/bc1bd6f77a5e25bf61fd70f89faa47552d557f2f/src/Aspire.Cli/Telemetry/TelemetryManager.cs#L37 as does the OTEL's own exporter Doc: https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/azuremonitorexporter/AUTHENTICATION.md

I also asked the devdiv data team about this; although they were unsure they did provide the full connection key for me to use which I was able to test empirically with.

Instrumentation keys are an old mechanism which are replaced by connection strings.

https://learn.microsoft.com/en-us/azure/azure-monitor/app/connection-strings
https://learn.microsoft.com/en-us/azure/azure-monitor/app/migrate-from-instrumentation-keys-to-connection-strings#whats-the-difference-between-global-and-regional-ingestion

 # Motivation
In #54733, I noted using `curl` that hitting the ingestion endpoint via the likely added 50-60ms on a median call (for me, not the median user). But after more testing, I found this actually **shaves 198ms median off the time to `POST` telemetry which means more data will get through and it will take less time to flush.**

Additionally, there is another win in that **data will not be lost** as it is with using an instrumentation key, see below.

# Background 
This documentation shown above outlines the following:
1. App Insights resources may be sharded regionally or ingested into one final bucket. If they are ingested into one bucket, there is only one ingestion endpoint. A global redirect may use _different_ regional endpoints may exist to route an instrumentation key to the ingestion endpoint but the ingestion endpoint is not globally distributed.
2. Data sent via ikeys might be lost - this is what we have observed. Now, the docs don't give a reason but we can assume it's because the redirects may fail, or servers may be transient, etc.

Empirically:

I noticed that for one and done environments, hitting the end point that resolves from the instrumentation key using curl for the first time would often fail, returning the following: `no data of the requested type` response.

I attempted to hit various endpoints and observed that they all finally redirected to the same place. (and that we only have `southcentralus` as a viable endpoint)

Endpoints hit to redirect from the Ikey:
URL	Result
https://dc.services.visualstudio.com/v2.1/track	307 to https://southcentralus-0.in.applicationinsights.azure.com/v2.1/track
https://dc.applicationinsights.azure.com/v2.1/track	same 307 target
https://dc.applicationinsights.microsoft.com/v2.1/track	same 307 target

(this comes from https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/monitor/Azure.Monitor.OpenTelemetry.Exporter/src/Internals/ConnectionString/Constants.cs)

`southcentralus` as the only viable endpoint:
URL	Result
southcentralus-0.in.applicationinsights.azure.com	200, itemsAccepted: 1
southcentralus.in.applicationinsights.azure.com	200, itemsAccepted: 1
centralus-2.in.applicationinsights.azure.com	400, Invalid instrumentation key
westus2-0.in.applicationinsights.azure.com	400, Invalid instrumentation key
japaneast-0.in.applicationinsights.azure.com	400, Invalid instrumentation key

# Further evidence:

Aspire and other repos already do this, https://github.com/microsoft/aspire/blob/bc1bd6f77a5e25bf61fd70f89faa47552d557f2f/src/Aspire.Cli/Telemetry/TelemetryManager.cs#L37 as does the OTEL's own exporter Doc: https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/azuremonitorexporter/AUTHENTICATION.md

I also asked the devdiv data team about this; although they were unsure they did provide the full connection key for me to use which I was able to test empirically with.
Copilot AI review requested due to automatic review settings July 2, 2026 21:52
@nagilson
nagilson requested review from a team and baronfel July 2, 2026 21:53

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates dotnetup’s Application Insights configuration to use a full Application Insights connection string (including ingestion endpoint) instead of relying on an instrumentation-key-only value, aligning with current Azure Monitor guidance and avoiding extra redirect/latency on ingestion.

Changes:

  • Replace the dotnetup telemetry constant from an ikey-only value to a full connection string including IngestionEndpoint, LiveEndpoint, and ApplicationId.

@dsplaisted

Copy link
Copy Markdown
Member

FYI @baronfel

@dsplaisted
dsplaisted merged commit 1851cbb into release/dnup Jul 3, 2026
16 checks passed
@dsplaisted
dsplaisted deleted the nagilson-dotnetup-telemetry-uses-connection-string-over-ikey branch July 3, 2026 20:08
pull Bot pushed a commit to Ucg2c3/sdk that referenced this pull request Jul 3, 2026
…ing over ikey

We should not use instrumentation keys, we should use connection strings. 

If you want more motivation and context see dotnet#55126.

Testing with SDK ('unlimited' timeout):
full connString exits ~250-300ms
ikey connString exits ~535-557ms
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants