[Monitor] `az monitor trace-association`, `az monitor account trace-container`: Add preview command groups for distributed traces by bragi92 · Pull Request #34263 · Azure/azure-cli

bragi92 · 2026-10-22T18:37:24Z

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests	Suppressions
⚠️ None	️✔️ 130/130	⚠️ 1 added

⚠️AzureCLI-BreakingChangeTest

⚠️monitor

rule cmd_name rule_message suggest_message

⚠️ 1011 - SubgroupAdd monitor account trace-container sub group monitor account trace-container added

⚠️ 1011 - SubgroupAdd monitor trace-association sub group monitor trace-association added

This PR adds warning or check suppressions. Fix the underlying warning where possible and justify each remaining suppression in a code comment or the PR description.

1 added suppression

File	Line	Kind	Code
`src/azure-cli/azure/cli/command_modules/monitor/operations/trace_association.py`	24	pylint	`class _Scope: # pylint: disable=too-few-public-methods`

Related command
az monitor trace-association create/show/list/delete
az monitor account trace-container create/show/update/wait

Description
Adds preview commands for distributed traces in Azure Monitor, on Microsoft.Monitor 2026-09-03-preview.

az monitor trace-association create --resource-uri <scope> --azure-monitor-workspace <workspace id> routes the traces of an Application Insights component, a resource group or a subscription to an Azure Monitor workspace. One command covers every scope; --resource-uri picks the API path.
- If the workspace has no trace container, the command creates it first: 30 days retention and trace metrics Enabled unless --trace-retention-days or --trace-metrics say otherwise. An existing container is never changed, and explicit settings that differ from it fail.
- Replacing the workspace of a resource group or subscription asks for confirmation (--yes skips it), because everything under that scope stops sending traces to the old workspace unless another association routes them there.
- After the write, the command reports the workspaces that receive the scope's traces. Associations are additive across a component, its resource group and its subscription.
show returns the association at exactly the scope, list adds the inherited ones, and delete removes only the scope's own association. Deleting at a resource group or subscription asks for confirmation; deleting where nothing is configured is a no-op.
az monitor account trace-container create/show/update/wait manage the workspace's trace container. create keeps the current value of any setting it is not given, and uses the defaults above for a new container.

Implementation notes:

AAZ command models: [monitor] Add trace preview atomic command models aaz#1131. The trace container commands are registered. The per-scope association commands (subscription, resource group, Application Insights component) are generated as unregistered helpers, and the --resource-uri commands dispatch to them.
Follows the az monitor sli onboarding: generated packages keep empty __init__.py files for args-guided loading. The trace-container create override lives in the operations/latest tree.

Testing Guide

az monitor account trace-container create -g MyResourceGroup -w MyWorkspace
az monitor trace-association create --resource-uri /subscriptions/{subscriptionID}/resourceGroups/MyResourceGroup --azure-monitor-workspace /subscriptions/{subscriptionID}/resourceGroups/MyResourceGroup/providers/Microsoft.Monitor/accounts/MyWorkspace
az monitor trace-association list --resource-uri /subscriptions/{subscriptionID}/resourceGroups/MyResourceGroup/providers/Microsoft.Insights/components/MyAppInsights
az monitor trace-association delete --resource-uri /subscriptions/{subscriptionID}/resourceGroups/MyResourceGroup --yes

test_monitor_trace_scenario.py: two scenario tests, recorded live in eastus2euap. Trace containers and Application Insights trace associations are only created in regions with traces enabled, and canary regions get them first.
test_monitor_unittest.py: unit tests for --resource-uri parsing, workspace ID validation and container settings.
azdev linter monitor passes. flake8 and pylint are clean on the changed files.

History Notes
[Monitor] az monitor trace-association: Add preview command group to route distributed traces from an Application Insights component, resource group or subscription to an Azure Monitor workspace
[Monitor] az monitor account trace-container: Add preview command group to manage the trace container of an Azure Monitor workspace

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

…ontainer`: Add preview command groups for distributed traces Route distributed traces from an Application Insights component, resource group or subscription to an Azure Monitor workspace with one command, `az monitor trace-association create --resource-uri`. It creates the workspace's trace container first if it has none and never changes an existing one. Replacing the workspace of a resource group or subscription, and deleting its association, ask for confirmation. The commands use Microsoft.Monitor 2026-09-03-preview through AAZ models from Azure/aaz#1131. The per-scope association commands are generated as unregistered helpers that the --resource-uri commands dispatch to. `trace-container create` keeps the current value of settings it is not given. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3fea4286-bba0-4628-84dc-866644c2595b

azure-pipelines · 2026-10-22T18:37:35Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Aditya Pujara (a0x1ab) · 2026-10-22T18:44:06Z

/azp run

azure-pipelines · 2026-10-22T18:44:29Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…and when settings conflict When explicit --trace-retention-days or --trace-metrics differ from the workspace's existing trace container, the error now says what the shared container keeps and recommends the exact `az monitor account trace-container update` command, or running without the flags. The container is still never changed by onboarding. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3fea4286-bba0-4628-84dc-866644c2595b

Aditya Pujara (a0x1ab) · 2026-10-23T17:17:23Z

/azp run

azure-pipelines · 2026-10-23T17:17:39Z

Azure Pipelines: Successfully started running 3 pipeline(s).

…ces needs write access on the workspace Access denied while reading or creating the trace container, and the LinkedAuthorizationFailed error that ARM returns when the caller cannot write the workspace, now explain that write access on the workspace is needed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 3fea4286-bba0-4628-84dc-866644c2595b

Aditya Pujara (a0x1ab) · 2026-10-26T19:32:05Z

/azp run

azure-pipelines · 2026-10-26T19:32:27Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Copilot

🟡 Changes recommended

Updating metrics or the duration window on a legacy container without traceRetentionInDays fails before the PUT, requiring default-handling logic and a regression test.

1 open issue

Add retention defaults when updating legacy containers · New

What changed in this PR

Adds preview distributed-tracing commands to Azure CLI’s Monitor module using the 2026-09-03-preview API.

Changes:

Adds scope-based trace associations with inheritance reporting and confirmation for resource-group and subscription changes.
Adds trace-container management, automatic creation, settings preservation, and validation.
Adds command help, unit tests, scenario tests, and a trace-container recording.

Paths below are relative to src/azure-cli/azure/cli/command_modules/monitor/.

File	Description
`tests/latest/test_monitor_unittest.py`	Tests scope parsing, settings, conflicts, and access errors.
`tests/latest/test_monitor_trace_scenario.py`	Exercises container and association workflows.
`tests/latest/recordings/test_monitor_trace_container.yaml`	Records trace-container scenario requests and responses.
`operations/trace_container.py`	Validates workspaces and manages container prerequisites.
`operations/trace_association.py`	Dispatches scope operations and reports trace destinations.
`operations/latest/monitor/account/trace_container/_create.py`	Preserves existing settings and supplies creation defaults.
`operations/latest/monitor/account/trace_container/__init__.py`	Initializes the container customization package.
`operations/latest/monitor/account/__init__.py`	Initializes the account customization package.
`commands.py`	Registers preview trace-association commands.
`aaz/latest/monitor/trace_association/subscription/_show.py`	Adds the subscription association read helper.
`aaz/latest/monitor/trace_association/subscription/_list.py`	Adds the subscription association list helper.
`aaz/latest/monitor/trace_association/subscription/_delete.py`	Adds the subscription association delete helper.
`aaz/latest/monitor/trace_association/subscription/_create.py`	Adds the subscription association write helper.
`aaz/latest/monitor/trace_association/subscription/__init__.py`	Initializes subscription helpers without eager imports.
`aaz/latest/monitor/trace_association/subscription/__cmd_group.py`	Defines unregistered subscription group metadata.
`aaz/latest/monitor/trace_association/resource/_show.py`	Adds the component association read helper.
`aaz/latest/monitor/trace_association/resource/_list.py`	Adds the component association list helper.
`aaz/latest/monitor/trace_association/resource/_delete.py`	Adds the component association delete helper.
`aaz/latest/monitor/trace_association/resource/_create.py`	Adds the component association write helper.
`aaz/latest/monitor/trace_association/resource/__init__.py`	Initializes component helpers without eager imports.
`aaz/latest/monitor/trace_association/resource/__cmd_group.py`	Defines unregistered component group metadata.
`aaz/latest/monitor/trace_association/resource_group/_show.py`	Adds the resource-group association read helper.
`aaz/latest/monitor/trace_association/resource_group/_list.py`	Adds the resource-group association list helper.
`aaz/latest/monitor/trace_association/resource_group/_delete.py`	Adds the resource-group association delete helper.
`aaz/latest/monitor/trace_association/resource_group/_create.py`	Adds the resource-group association write helper.
`aaz/latest/monitor/trace_association/resource_group/__init__.py`	Initializes resource-group helpers without eager imports.
`aaz/latest/monitor/trace_association/resource_group/__cmd_group.py`	Defines unregistered resource-group metadata.
`aaz/latest/monitor/trace_association/__init__.py`	Initializes the generated association package.
`aaz/latest/monitor/trace_association/__cmd_group.py`	Defines unregistered association group metadata.
`aaz/latest/monitor/account/trace_container/_wait.py`	Adds container condition polling.
`aaz/latest/monitor/account/trace_container/_update.py`	Adds container settings updates.
`aaz/latest/monitor/account/trace_container/_show.py`	Adds container retrieval.
`aaz/latest/monitor/account/trace_container/_create.py`	Adds container creation and operation polling.
`aaz/latest/monitor/account/trace_container/__init__.py`	Initializes container commands without eager imports.
`aaz/latest/monitor/account/trace_container/__cmd_group.py`	Registers the preview container command group.
`_params.py`	Defines association arguments and settings options.
`_help.py`	Documents association behavior and examples.

_{Review effort: Balanced}

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5f924a07-a586-442e-97de-0529c398c64d

Aditya Pujara (a0x1ab) · 2026-11-02T21:12:18Z

/azp run

azure-pipelines · 2026-11-02T21:12:37Z

Azure Pipelines: Successfully started running 3 pipeline(s).

Yong Zhang (yonzhan) · 2026-11-02T22:18:26Z

Please fix CI issues

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5f924a07-a586-442e-97de-0529c398c64d

Aditya Pujara (a0x1ab) · 2026-11-03T17:28:14Z

/azp run

azure-pipelines · 2026-11-03T17:28:32Z

Azure Pipelines: Successfully started running 3 pipeline(s).

bragi92 · 2026-11-03T18:35:23Z

The ci test failures look like timeouts in the build pipeline and unrelated to my change? Yong Zhang (@yonzhan)

Unit Test for Core Python314:
The job running on agent pool-ubuntu-2204 42 ran longer than the maximum time of 10 minutes.

Unit Test for Telemetry Python312:
The job running on agent pool-ubuntu-2204 45 ran longer than the maximum time of 10 minutes.

Unit Test for Telemetry Python314:
The job running on agent pool-ubuntu-2204 43 ran longer than the maximum time of 10 minutes

Yong Zhang (yonzhan) · 2026-11-03T22:14:40Z

/azp run

azure-pipelines · 2026-11-03T22:14:56Z

Azure Pipelines: Successfully started running 3 pipeline(s).

x-engineering-agent · 2026-11-05T01:34:06Z

bragi92 Resolve the legacy-update and generated-source findings before merge. Scenario coverage is unverified.

	Check	Status	Detail
	Upstream CI		52 successful completed checks; no CI failures in the handoff.
	Agent live tests		This is a review-only PR.
	Regression coverage		For `monitor`: 2 focused test file(s) and 2 recording file(s) changed.
	Findings		2 high, 1 medium
	Risk		High; owner review recommended

To address

Tick each item as you address it.

Generated code ownership checker

Details and fix

src/azure-cli/azure/cli/command_modules/monitor/aaz/latest/monitor/account/trace_container/__cmd_group.py:1, src/azure-cli/azure/cli/command_modules/monitor/aaz/latest/monitor/account/trace_container/__init__.py:1, src/azure-cli/azure/cli/command_modules/monitor/aaz/latest/monitor/account/trace_container/_create.py:1, src/azure-cli/azure/cli/command_modules/monitor/aaz/latest/monitor/account/trace_container/_show.py:1, src/azure-cli/azure/cli/command_modules/monitor/aaz/latest/monitor/account/trace_container/_update.py:1 and 21 more location(s): A generated file changed without an open or merged Azure/aaz pull request containing the durable command-model change.

Remediation: Make the durable command-model change in Azure/aaz, link that PR in this description, then regenerate the downstream aaz/<profile> output.

Verify: Regenerate from a clean checkout and confirm the resulting diff contains this change and the linked source PR is open or merged.
Legacy partial update fails before PUT

Details and fix

src/azure-cli/azure/cli/command_modules/monitor/aaz/latest/monitor/account/trace_container/_update.py:95-102,291-297,395-398: GET can load a container without traceRetentionInDays. Metrics/window-only updates leave it absent; PUT serialization requires it and raises Missing a required field in request content: traceRetentionInDays before transmission. This PR-related client failure is confirmed by the changed command's traced serialization path, not by a failed CI run.

Remediation: Add a handwritten Update override filling only still-missing settings after updates, preserving existing values and explicit named/generic arguments. Make durable model changes in Azure/aaz, not generated output alone.

Verify: Add the missing-retention command case, existing nondefault retention, explicit/generic retention and --no-wait. Copilot feedback 4407558748 is confirmed and consolidated here: line 99 applies arguments; validation fails later during PUT construction.
Test semantic-strength reviewer

Details and fix

src/azure-cli/azure/cli/command_modules/monitor/tests/latest/test_monitor_unittest.py:211: New scenario test has no recording in this PR: test_monitor_trace_association_scope, test_monitor_trace_workspace_id, test_monitor_trace_container_settings, test_monitor_trace_container_conflict, test_monitor_trace_container_access.

Remediation: Run the test live and commit its recording, or mark it live only when it cannot be replayed.

Verify: Confirm the test passes in playback mode from the committed recording.

Test-strength disposition: The five named methods are helper/mock unit tests in MonitorTraceTest(unittest.TestCase) (test_monitor_unittest.py:213-310), not service scenarios; that recording warning is a false positive. Legacy-update command coverage is still needed.

Review details

Upstream CI

52 successful completed checks; no CI failures in the handoff.

Test validation

Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
Regression coverage: For monitor: 2 focused test file(s) and 2 recording file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually.

Author evidence under src/azure-cli/azure/cli/command_modules/monitor/tests/latest/: test_monitor_trace_scenario.py:20-110 and recordings/test_monitor_trace_container.yaml, recordings/test_monitor_trace_association.yaml cover creation, explicit retention updates, preserved settings, workspace IDs and inheritance. Successful container GETs include retention; missing-retention partial updates are not covered. Add that command-level GET/PUT regression, rerun both scenario tests in playback, and obtain focused service recordings through the supported workflow. No Agent rerun occurred here.

Risk assessment

55/100 · High

The High rating is driven by public CLI behavior, failure-handling behavior, generated output.

Change scope: 38 changed files, 7757 changed lines (+7757 / -0), including 34 production files.
Affected components: monitor
Risk drivers: public CLI behavior (+18); failure-handling behavior (+12); generated output (+12)
Regression evidence: Changed regression tests are included, reducing risk.
Confidence: High because changed-line patches were available for every production file.
Required review: Owning-squad review is recommended for monitor before merge.

Ask the Agent

Tick a box to queue an action. Requires write access to this repository.

Re-review this PR
Run Agent live tests on this PR

_{X Engineering Agent · Reviewer · React with +1 or -1 to train the agent}

mansoor sarfraz (msarfraz)

LGTM. Please make sure Azure/aaz#1131 is merged before (or together with) this PR so the generated command models and the CLI stay in sync.

microsoft-github-policy-service Bot added Monitor az monitor act-observability-squad labels Oct 22, 2026

x-engineering-agent Bot requested a review from a team October 22, 2026 18:46

x-engineering-agent Bot added this to the November 2026 (2026-11-16)❗ Breaking change release ❗ milestone Oct 22, 2026

This was referenced Oct 22, 2026

[application-insights] Add distributed trace onboarding and management Azure/azure-cli-extensions#10479

Closed

[monitor] Add trace preview atomic command models Azure/aaz#1131

Merged

bragi92 marked this pull request as ready for review October 29, 2026 00:33

Copilot AI balanced review requested due to automatic review settings October 29, 2026 00:33

Copilot started reviewing on behalf of bragi92 October 29, 2026 00:34

View session

Copilot AI reviewed Oct 29, 2026

View reviewed changes

Comment thread ...-cli/azure/cli/command_modules/monitor/aaz/latest/monitor/account/trace_container/_update.py Resolved

{Monitor} Remove trace metrics billing claims from help

3ddf195

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5f924a07-a586-442e-97de-0529c398c64d

Yong Zhang (yonzhan) assigned mansoor sarfraz (msarfraz) Nov 2, 2026

Yong Zhang (yonzhan) requested a review from a team November 2, 2026 22:18

zanejohnson-azure reviewed Nov 2, 2026

View reviewed changes

Comment thread src/azure-cli/azure/cli/command_modules/monitor/operations/trace_container.py Resolved

{Monitor} Reject workspace IDs without a resource group

7f8dd8b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5f924a07-a586-442e-97de-0529c398c64d

mansoor sarfraz (msarfraz) added the Request X Engineering Agent Ask the agent to triage this issue or review this PR label Nov 5, 2026

mansoor sarfraz (msarfraz) approved these changes Nov 5, 2026

View reviewed changes

x-engineering-agent Bot added the X Engineering Agent Reviewed Agent reviewed this PR label Nov 5, 2026

mansoor sarfraz (msarfraz) merged commit 6e9b6fd into Azure:dev Nov 6, 2026
58 checks passed

rule	cmd_name	rule_message	suggest_message
⚠️ 1011 - SubgroupAdd	monitor account trace-container	sub group `monitor account trace-container` added
⚠️ 1011 - SubgroupAdd	monitor trace-association	sub group `monitor trace-association` added

Conversation

bragi92 commented Oct 22, 2026 • edited by x-engineering-agent Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 PR Validation — ⚠️ Review suggested

Uh oh!

azure-pipelines Bot commented Oct 22, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 22, 2026

Uh oh!

azure-pipelines Bot commented Oct 22, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 23, 2026

Uh oh!

azure-pipelines Bot commented Oct 23, 2026

Uh oh!

Aditya Pujara (a0x1ab) commented Oct 26, 2026

Uh oh!

azure-pipelines Bot commented Oct 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Nov 2, 2026

Uh oh!

azure-pipelines Bot commented Nov 2, 2026

Uh oh!

Yong Zhang (yonzhan) commented Nov 2, 2026

Uh oh!

Uh oh!

Aditya Pujara (a0x1ab) commented Nov 3, 2026

Uh oh!

azure-pipelines Bot commented Nov 3, 2026

Uh oh!

bragi92 commented Nov 3, 2026

Uh oh!

Yong Zhang (yonzhan) commented Nov 3, 2026

Uh oh!

azure-pipelines Bot commented Nov 3, 2026

Uh oh!

x-engineering-agent Bot commented Nov 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

To address

Upstream CI

Test validation

Risk assessment

Uh oh!

mansoor sarfraz (msarfraz) left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

bragi92 commented Oct 22, 2026 •

edited by x-engineering-agent Bot

Loading

x-engineering-agent Bot commented Nov 5, 2026 •

edited

Loading