Datadog's Azure Integration No Longer Needs a Secret to Rotate
Enterprise Developer PlatformsDatadog’s Azure integration now supports secretless authentication — and the operational case for switching is simple: static client secrets expire, and expired credentials mean monitoring gaps at exactly the moments you need monitoring most.
The Framework
Secretless authentication replaces the static credential rotation model with OpenID Connect (OIDC)-based federated identity. Instead of storing a long-lived client secret in Datadog and rotating it periodically, the integration establishes trust directly between a Microsoft Entra ID app registration and Datadog’s OIDC issuer. When Datadog needs Azure access, it presents an OIDC token; Entra ID validates the trust relationship and issues a short-lived access token on the spot.
No static secret. No expiration date to track. No rotation schedule to maintain. No telemetry interruption when someone’s calendar reminder falls through a gap in an on-call rotation.
How It Works
Trust establishment
Create a federated identity credential in Microsoft Entra ID that points at Datadog’s OIDC issuer endpoint. This is a one-time configuration, not an ongoing credential management task.
Token exchange
At runtime, Datadog presents an OIDC token to Entra ID. Entra ID validates the trust relationship configured in the app registration and issues a short-lived Azure access token scoped to the integration’s required permissions.
Access without storage
Datadog never stores a long-lived authentication secret. The access tokens are ephemeral — issued for each authentication event, not persisted.
Adoption paths
Teams can set this up through multiple paths: Quickstart during initial Datadog Azure integration setup, Terraform for infrastructure-as-code provisioning, or the Azure portal. Existing integrations can migrate without creating new app registrations — the trust relationship updates in place.
Where It Doesn’t Apply
Secretless authentication requires Microsoft Entra ID as the identity provider. Teams running Azure environments with non-standard identity configurations, or integrations that don’t support federated credentials, remain on the static secret path for now. The OIDC trust model is also dependent on Datadog’s issuer endpoint availability — though given Datadog’s SLA profile, this is a theoretical dependency rather than a practical one.
The So What
Credential rotation failure is a top-tier cause of unexpected monitoring gaps in enterprise environments. It’s unglamorous, preventable, and disproportionately expensive because it tends to happen during high-load periods when someone is focused on something else. Secretless authentication removes the failure mode entirely. For platform teams managing Datadog at scale across Azure environments, the switch is a straightforward operational improvement: one less rotating secret, one fewer class of monitoring incident. Given that Datadog’s API authentication detection already covers anomalous credential behavior, removing static secrets from the equation tightens the overall security surface as well. Set it up via Quickstart or Terraform and retire the rotation calendar entry.
Source: Datadog Blog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →