---
title: "Avoid Azure secret rotation with secretless authentication"
description: "Learn how secretless authentication for Datadog’s Azure integration helps prevent telemetry interruptions that result from expired client secrets."
author: "Cody Murray-Bruce, Ben Johnson-Staub"
date: 2026-08-12
tags: ["infrastructure monitoring", "azure", "identity and access management"]
blog_type_id: the-monitor
locale: en
---

Many observability platforms authenticate to Microsoft Azure by using client secrets. Teams must create, store, and periodically rotate these secrets to keep receiving the telemetry data that they need. This recurring maintenance adds operational overhead and increases the risk of ingestion outages that occur when secrets expire.

Secretless authentication removes the burden of credential management for [Datadog’s Azure integration](https://docs.datadoghq.com/integrations/azure.md), replacing client secrets with an identity-based authentication model. You no longer need to create, store, or rotate client secrets, and Datadog no longer stores a long-lived authentication secret.

In this post, you'll learn [how secretless authentication works](#how-secretless-authentication-works) and how you can [configure or migrate to secretless authentication](#configure-or-migrate-to-secretless-authentication-for-azure).

## How secretless authentication works

Secretless authentication replaces static client secrets with a trust relationship based on identity. A federated identity credential in Microsoft Entra ID establishes trust between your Azure app registration and Datadog's OpenID Connect (OIDC) issuer.

The following diagram illustrates the authentication flow. When Datadog requests access to Azure telemetry data, it presents an OIDC token to Entra ID. Entra ID validates the configured trust relationship and issues a short-lived access token. Datadog then uses that token to collect the telemetry data.

![Diagram of Datadog requesting an OIDC token, Microsoft Entra ID validating a federated credential, and Datadog using a short-lived access token to collect Azure telemetry data.](https://web-assets.dd-static.net/42588/1786539329-datadog-azure-secretless-authentication-workflow.png)

## Configure or migrate to secretless authentication for Azure

You can opt for secretless authentication during [Azure integration onboarding](https://www.datadoghq.com/blog/azure-integration-onboarding.md) and for Azure integrations that you’ve already configured. When you use the [Quickstart workflow](https://docs.datadoghq.com/getting_started/integrations/azure.md?tab=createanappregistration#quickstart-setup) or [Terraform](https://docs.datadoghq.com/getting_started/integrations/azure.md?tab=createanappregistration#terraform-setup) to create the app registration during onboarding, select secretless authentication instead of providing a client secret. After you complete the remaining onboarding steps for Quickstart or Terraform, Azure establishes the federated trust relationship during setup.

![Azure integration setup screen with secretless authentication selected as the authentication method.](https://web-assets.dd-static.net/42588/1786539392-datadog-azure-authentication-method.png)

If your Azure integration already uses an app registration with a client secret, you can migrate to secretless authentication without creating a new app registration. The [migration workflow](https://docs.datadoghq.com/getting_started/integrations/azure.md?tab=createanappregistration#secretless-migration-setup) supports the Azure CLI, Terraform, and the [Azure portal](https://portal.azure.com/), enabling you to choose the setup method that best matches your deployment practices.

![Secretless authentication setup screen showing the Azure CLI, Terraform, and Azure portal options with credential verification steps.](https://web-assets.dd-static.net/42588/1786539448-datadog-azure-secretless-authentication-setup.png)

## Reduce authentication maintenance for your Azure integration

Secretless authentication for Datadog’s Azure integration replaces client secrets with federated identity. As a result, teams can avoid client secret rotation, prevent outages caused by expired credentials, and reduce the number of long-lived credentials that they manage. To learn more, [read the setup instructions in our Getting Started with Azure documentation](https://docs.datadoghq.com/getting_started/integrations/azure.md?tab=createanappregistration#setup).

If you don't already have a Datadog account, you can <!-- Sign-up trigger (sign up for a 14-day free trial) omitted --> to start monitoring your Azure environments.