Support TenantId and AuthorityHost in APPLICATIONINSIGHTS_AUTHENTICATION_STRING

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## Unreleased
 
+### Bug fixes
+
+* Support `TenantId` and `AuthorityHost` in `APPLICATIONINSIGHTS_AUTHENTICATION_STRING` so that
+  client secret authentication configured via the environment variable can work
+  ([#4892](https://github.com/microsoft/ApplicationInsights-Java/pull/4892))
+
 ## Version 3.7.10 GA (09/17/2026)
 
 ### Enhancements

agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/Configuration.java

@@ -1619,7 +1619,8 @@ public void validate() {
         if (isEmpty(tenantId)) {
           throw new FriendlyException(
               "AAD Authentication configuration of type Client Secret Identity is missing \"tenantId\".",
-              "Please provide a valid \"tenantId\" under the \"authentication\" configuration. "
+              "Please provide a valid \"tenantId\" under the \"authentication\" configuration, "
+                  + "or add \"TenantId={TENANT_ID}\" to the APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable. "
                   + "Learn more about authentication configuration here: https://docs.microsoft.com/en-us/azure/azure-monitor/app/java-standalone-config#authentication");
         }
 
@@ -1639,6 +1640,8 @@ public enum AuthenticationType {
     SAMI, // APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD,
     @Deprecated
     VSCODE,
+    // APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD;ClientId={CLIENT_ID};
+    // ClientSecret={CLIENT_SECRET};TenantId={TENANT_ID}[;AuthorityHost={AUTHORITY_HOST}]
     @Deprecated
     CLIENTSECRET
   }

agent/agent-tooling/src/main/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationBuilder.java

@@ -275,7 +275,7 @@ private static void logConfigurationWarnings(Configuration config) {
       configurationLogger.warn(
           "\"clientsecret\" json configuration has been deprecated since 3.5.0 GA. Please use \"user-assigned managed identity\" or \"system-assigned managed identity\" instead. "
               + "If you're on premise, you can use APPLICATIONINSIGHTS_AUTHENTICATION_STRING environment variable to pass the client ID and secret, "
-              + "e.g. APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD;ClientId={CLIENT_ID};ClientSecret={CLIENT_SECRET}.");
+              + "e.g. APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD;ClientId={CLIENT_ID};ClientSecret={CLIENT_SECRET};TenantId={TENANT_ID}.");
     }
     if (config.sampling.requestsPerSecond != null && config.sampling.percentage != null) {
       configurationLogger.warn(
@@ -516,6 +516,11 @@ private static void overlayAadEnvVars(
             // Override type to Client Secret
             config.authentication.type = Configuration.AuthenticationType.CLIENTSECRET;
             config.authentication.clientSecret = clientSecret;
+            config.authentication.tenantId = keyValueMap.get("TenantId");
+            String authorityHost = keyValueMap.get("AuthorityHost");
+            if (authorityHost != null && !authorityHost.isEmpty()) {
+              config.authentication.authorityHost = authorityHost;
+            }
           } else {
             // Override type to User Assigned Managed Identity
             config.authentication.type = Configuration.AuthenticationType.UAMI;

agent/agent-tooling/src/test/java/com/microsoft/applicationinsights/agent/internal/configuration/ConfigurationTest.java

@@ -10,6 +10,7 @@
 import com.fasterxml.jackson.databind.DeserializationFeature;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException;
+import com.microsoft.applicationinsights.agent.internal.common.FriendlyException;
 import com.microsoft.applicationinsights.agent.internal.configuration.Configuration.JmxMetric;
 import com.microsoft.applicationinsights.agent.internal.configuration.Configuration.MatchType;
 import com.microsoft.applicationinsights.agent.internal.configuration.Configuration.PreviewConfiguration;
@@ -705,6 +706,36 @@ void shouldOverrideAadAuthenticationConfig() throws IOException {
         .isEqualTo(Configuration.AuthenticationType.CLIENTSECRET);
     assertThat(configuration3.authentication.clientId).isEqualTo("12345678");
     assertThat(configuration3.authentication.clientSecret).isEqualTo("clientsecret123");
+    assertThat(configuration3.authentication.tenantId).isNull();
+    assertThatThrownBy(configuration3.authentication::validate)
+        .isInstanceOf(FriendlyException.class)
+        .hasMessageContaining("missing \"tenantId\"");
+
+    envVars.put(
+        "APPLICATIONINSIGHTS_AUTHENTICATION_STRING",
+        "Authorization=AAD;ClientId=12345678;ClientSecret=clientsecret123;TenantId=tenant123");
+    Configuration configuration4 = loadConfiguration("applicationinsights_aadauthenv.json");
+    ConfigurationBuilder.overlayFromEnv(
+        configuration4, Paths.get("."), this::envVars, this::systemProperties);
+    assertThat(configuration4.authentication.type)
+        .isEqualTo(Configuration.AuthenticationType.CLIENTSECRET);
+    assertThat(configuration4.authentication.clientId).isEqualTo("12345678");
+    assertThat(configuration4.authentication.clientSecret).isEqualTo("clientsecret123");
+    assertThat(configuration4.authentication.tenantId).isEqualTo("tenant123");
+    assertThat(configuration4.authentication.authorityHost).isNull();
+    configuration4.authentication.validate();
+
+    envVars.put(
+        "APPLICATIONINSIGHTS_AUTHENTICATION_STRING",
+        "Authorization=AAD;ClientId=12345678;ClientSecret=clientsecret123;TenantId=tenant123;"
+            + "AuthorityHost=https://login.microsoftonline.us/");
+    Configuration configuration5 = loadConfiguration("applicationinsights_aadauthenv.json");
+    ConfigurationBuilder.overlayFromEnv(
+        configuration5, Paths.get("."), this::envVars, this::systemProperties);
+    assertThat(configuration5.authentication.tenantId).isEqualTo("tenant123");
+    assertThat(configuration5.authentication.authorityHost)
+        .isEqualTo("https://login.microsoftonline.us/");
+    configuration5.authentication.validate();
   }
 
   @Test