{
  "slug": "az-aks-adds-container-insights-onboarding-and-offboarding-flags-6ad0a422f240",
  "title": "az aks adds Container Insights onboarding and offboarding flags",
  "tools": [
    "az"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-06T00:00:00.000Z",
  "announced_at": "2026-10-06T00:00:00.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When enabling Container Insights on a new or existing managed-identity AKS cluster, use `az aks create` or `az aks update` with `--enable-azure-monitor-logs`; to turn it off, use `az aks update` with `--disable-azure-monitor-logs`. Replace deprecated `--enable-msi-auth-for-monitoring` with `--enable-azure-monitor-logs` where applicable.",
    "examples": [
      "az aks create --resource-group <resource-group> --name <cluster-name> --enable-azure-monitor-logs",
      "az aks update --resource-group <resource-group> --name <cluster-name> --enable-azure-monitor-logs",
      "az aks update --resource-group <resource-group> --name <cluster-name> --disable-azure-monitor-logs"
    ],
    "gotchas": [
      "Version: 2.91.0",
      "--resource-group, -g (required): Name of the resource group. [Reference](https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest)",
      "--name, -n (required): Name of the managed cluster. [Reference](https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest)",
      "--enable-azure-monitor-logs: Enables Azure Monitor logs (Container Insights) using managed identity authentication; documented default is false.",
      "--disable-azure-monitor-logs: Disables Azure Monitor logs (Container Insights); documented default is false.",
      "--enable-msi-auth-for-monitoring: Deprecated; accepted values are false or true. Use `--enable-azure-monitor-logs` instead.",
      "Prerequisite: The cluster must use a managed identity; service-principal-authenticated clusters are unsupported.",
      "Prerequisite: Clusters still using legacy shared-key authentication must first migrate to managed identity authentication.",
      "`--enable-msi-auth-for-monitoring` is deprecated in favor of `--enable-azure-monitor-logs`.",
      "The onboarding flag uses the Azure Monitor profile and managed identity authentication."
    ]
  },
  "why_it_matters": "Enable or disable Container Insights while creating or maintaining an AKS cluster.",
  "before": "Use `--enable-msi-auth-for-monitoring` for monitoring managed identity authentication.",
  "sources": [
    "https://learn.microsoft.com/en-us/cli/azure/release-notes-azure-cli#october-06-2026",
    "https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest"
  ],
  "rank": 0.92046,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2b-20261017",
    "verdict_id": "wave2b-20261017:wave2b-20261017-26ac0c8577e18a13-6:gate",
    "evidence_hash": "0f388b2fa2bed706c6618ec623ab042381a9e76a75c551fdf6717a04f3cc55ef"
  },
  "review": {
    "draft_hash": "7a95e735a58dbfcd5164169709acdf21e71b7a5e513cedc1808322d6025f0559",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2b-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.92 >= 0.9; 2 needed) and Jev gave 0.68 (>= 0.6 needed)."
  }
}