Sysadmin Central

<#
.SYNOPSIS
    Discovers Application Insights components with configured API Keys across your accessible subscriptions, ahead of the retirement of API key based querying of Application Insights data (api.applicationinsights.io).
.DESCRIPTION
    Authenticates as your own Entra user (interactive), enumerates every Microsoft.Insights/components resource you can see, and lists the API Keys configured against each one.
    The retirement specifically affects querying telemetry from the data plane API using an API key. Keys carrying the ReadTelemetry permission (the '/api' linked read property) are the ones directly impacted, and are flagged as such. Keys that only carry WriteAnnotations are reported but not flagged.
    Listing keys never returns the secret value (Azure only reveals that once at creation), so this reports on existence, permissions, and creation date.
    Read only. Requires no more than Reader on the target subscriptions.
.PARAMETER SubscriptionId
    One or more subscription IDs to scope the scan to. Defaults to all enabled subscriptions in the signed in context.
.PARAMETER TenantId
    Optional tenant to authenticate against, if you span more than one.
.PARAMETER OutputPath
    CSV export path. Defaults to a timestamped file in the current directory.
.EXAMPLE
    .\Find-AppInsightsApiKeys.ps1
.EXAMPLE
    .\Find-AppInsightsApiKeys.ps1 -SubscriptionId 'xxxx-xxxx','yyyy-yyyy' -Verbose
.NOTES
    Requires: Az.Accounts, Az.ApplicationInsights
#>
[CmdletBinding()]
param(
    [string[]] $SubscriptionId,
    [string]   $TenantId,
    [string]   $OutputPath = ".\AppInsights-ApiKeys-$(Get-Date -Format 'yyyyMMdd-HHmmss').csv"
)
# Import required modules
foreach ($module in 'Az.Accounts', 'Az.ApplicationInsights') {
    if (-not (Get-Module -ListAvailable -Name $module)) {
        throw "Required module '$module' is not installed. Run: Install-Module $module -Scope CurrentUser"
    }
}
# Authenticate as your Entra user
$context = Get-AzContext
if (-not $context -or ($TenantId -and $context.Tenant.Id -ne $TenantId)) {
    Write-Host "Signing in interactively..."
    $connectParams = @{}
    if ($TenantId) {
        $connectParams['TenantId'] = $TenantId
    }
    Connect-AzAccount @connectParams | Out-Null
}
# Resolve target subscriptions
$subs = Get-AzSubscription -TenantId $TenantId -ErrorAction SilentlyContinue | Where-Object { $_.State -eq 'Enabled' }
if ($SubscriptionId) {
    $subs = $subs | Where-Object { $_.Id -in $SubscriptionId }
}
if (-not $subs) {
    throw "No enabled subscriptions found for the current context."
}
Write-Host "Scanning $($subs.Count) subscriptions for Application Insights API keys..." -ForegroundColor Cyan
# Collapses the property leaves into the portal's friendly permission names.
# ReadTelemetry expands to several read leaves (api, draft, extendqueries, search, aggregate) the presence of 'api' is the reliable marker for it.
function Get-PermissionName {
    param([string[]] $LinkedProperties)
    if (-not $LinkedProperties) { return @() }
    $leaves = $LinkedProperties | ForEach-Object { ($_ -split '/')[-1] }
    $perms  = [System.Collections.Generic.List[string]]::new()
    if ($leaves -contains 'api')         { [void]$perms.Add('ReadTelemetry') }
    if ($leaves -contains 'agentconfig') { [void]$perms.Add('AuthenticateSDKControlChannel') }
    if ($leaves -contains 'annotations') { [void]$perms.Add('WriteAnnotations') }
    # Surface anything unrecognised rather than silently dropping it
    $known = 'api', 'draft', 'extendqueries', 'search', 'aggregate', 'agentconfig', 'annotations'
    foreach ($leaf in ($leaves | Where-Object { $_ -notin $known } | Select-Object -Unique)) {
        [void]$perms.Add($leaf)
    }
    $perms
}
# Loop through each subscription, enumerate the Application Insights components, and then enumerate the API keys for each component.
$results = foreach ($sub in $subs) {
    Set-AzContext -SubscriptionId $sub.Id -TenantId $sub.TenantId | Out-Null
    Write-Host "Subscription: $($sub.Name) ($($sub.Id))"
    $components = Get-AzApplicationInsights -ErrorAction SilentlyContinue
    foreach ($comp in $components) {
        try {
            $keys = Get-AzApplicationInsightsApiKey -ResourceGroupName $comp.ResourceGroupName -Name $comp.Name -ErrorAction Stop
        }
        catch {
            Write-Warning "Could not read keys for '$($comp.Name)' in '$($sub.Name)': $($_.Exception.Message)"
            continue
        }
        foreach ($key in $keys) {
            $readPerms  = Get-PermissionName -LinkedProperties $key.LinkedReadProperty
            $writePerms = Get-PermissionName -LinkedProperties $key.LinkedWriteProperty
            # Normalise the created date to a clean, unambiguous string Excel reads as a date.
            $parsedDate = [datetime]::MinValue
            $created = if ([datetime]::TryParse($key.CreatedDate, [ref]$parsedDate)) {
                $parsedDate.ToString('yyyy-MM-dd HH:mm:ss')
            } else { $key.CreatedDate }
            [PSCustomObject]@{
                Subscription         = $sub.Name
                ResourceGroup        = $comp.ResourceGroupName
                InstanceName         = $comp.Name
                Location             = $comp.Location
                # DisableLocalAuth = $true means keys already cannot query, so no action needed, couldn't see this set in my environment but should work normally
                LocalAuthDisabled    = if ($null -ne $comp.DisableLocalAuth) { $comp.DisableLocalAuth } else { 'Unknown' }
                ApiKeyName           = $key.Name
                ApiKeyId             = $key.Id
                Created              = $created
                ReadPermissions      = ($readPerms  -join ', ')
                WritePermissions     = ($writePerms -join ', ')
                ImpactedByRetirement = [bool]($readPerms -contains 'ReadTelemetry')
            }
        }
    }
}
# Report
if (-not $results) {
    Write-Host "No Application Insights API keys found in scope. Nothing to action." -ForegroundColor Green
    return
}
$results |
    Sort-Object -Property @{ Expression = 'ImpactedByRetirement'; Descending = $true }, Subscription, InstanceName |
    Format-Table Subscription, InstanceName, ApiKeyName, ReadPermissions, LocalAuthDisabled, ImpactedByRetirement -AutoSize
$impacted = ($results | Where-Object ImpactedByRetirement).Count
Write-Host ""
Write-Host "Found $($results.Count) API key(s) across $($subs.Count) subscription(s)." -ForegroundColor Cyan
Write-Host "$impacted of these carry ReadTelemetry and are directly impacted by the query-data retirement." -ForegroundColor Yellow
Write-Host "Full detail exported to: $OutputPath" -ForegroundColor Cyan
$results | Export-Csv -Path $OutputPath -NoTypeInformation -Encoding UTF8
Invoke-Item $OutputPath