Live Metrics (QuickPulse) exporter doesn't fall back to APPLICATIONINSIGHTS_AUTHENTICATION_STRING for AAD auth

[larohra]

• Package Name: azure-monitor-opentelemetry-exporter (via azure-monitor-opentelemetry distro)
• Package Version: 1.0.0b53 (via azure-monitor-opentelemetry==1.8.8). Confirmed the same gap is present on main today (2026-07-24) in _quickpulse/_exporter.py.
• Operating System: Linux (Azure Functions Linux Python worker, Consumption/Flex)
• Python Version: 3.13

Describe the bug

When an Application Insights resource requires Entra ID (AAD) authentication (DisableLocalAuth=true) and the app authenticates using the standard App Service/Functions "Authentication type" convention (env var APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD;ClientId=<guid> + AZURE_CLIENT_ID), regular telemetry (traces/logs/metrics) exports successfully, but the Live Metrics (QuickPulse) exporter continuously fails with a 401:

azure.core.exceptions.ClientAuthenticationError: Operation returned an invalid status 'Unauthorized'
Content: {"RequestId":"...","Code":"InvalidOperation","Message":"The Agent/SDK does not have permissions to send telemetry to this resource.","Exception":""}

logged every ~1s as "Exception occurred while publishing live metrics." from _quickpulse/_exporter.py's export()/_ping().

This happens even though:

• The identity has the Monitoring Metrics Publisher role correctly assigned on the App Insights resource (confirmed via az role assignment list).
• Regular telemetry ingests successfully in the same process/timeframe (confirmed via Log Analytics: requests/traces/dependencies all ingest with 100% success while ~1,050 QuickPulse ClientAuthenticationErrors occurred over the same 13-minute window).

Root cause (found via source inspection)

1. BaseExporter.__init__ (azure/monitor/opentelemetry/exporter/export/_base.py) resolves the credential via _get_authentication_credential(**kwargs). When no explicit credential kwarg is supplied, that helper falls back to reading APPLICATIONINSIGHTS_AUTHENTICATION_STRING from the environment directly and builds a ManagedIdentityCredential(client_id=...) when it sees Authorization=AAD;ClientId=.... This is why regular exporters (trace/log/metric) authenticate correctly.
2. _QuickpulseExporter.__init__ (azure/monitor/opentelemetry/exporter/_quickpulse/_exporter.py) only does:

   self._credential = kwargs.get("credential")

   with no fallback to _get_authentication_credential() and no env-var parsing at all. If the caller never explicitly passes credential=, this stays None.
3. The azure-monitor-opentelemetry distro's _get_configurations() (_utils/configurations.py) has _default_* helper functions for several settings (e.g. _default_connection_string, _default_enable_live_metrics) but no _default_credential — so the credential key is simply absent from the configurations dict passed to enable_live_metrics(**configurations) → QuickpulseManager.initialize(**kwargs) → _QuickpulseExporter(**kwargs).

Net effect: any app that relies on the APPLICATIONINSIGHTS_AUTHENTICATION_STRING env-var convention (rather than passing credential= explicitly to configure_azure_monitor()) gets working AAD auth for all telemetry except Live Metrics, which silently gets credential=None and is rejected by any AAD-only Application Insights resource.

To Reproduce

1. Create an Application Insights resource with DisableLocalAuth=true.
2. Deploy an app (e.g. Azure Functions Python) with a managed identity that has Monitoring Metrics Publisher on that resource.
3. Set APPLICATIONINSIGHTS_AUTHENTICATION_STRING=Authorization=AAD;ClientId=<identity-client-id> (the standard App Service "Application Insights Authentication type" setting) and APPLICATIONINSIGHTS_CONNECTION_STRING=<connection string>.
4. In app code, call configure_azure_monitor(connection_string=connection_string) with no explicit credential= kwarg (Live Metrics is enabled by default).
5. Observe: regular telemetry ingests fine; Live Metrics continuously logs ClientAuthenticationError / "Exception occurred while publishing live metrics."

Expected behavior

Live Metrics should authenticate the same way regular exporters do when AAD is configured via APPLICATIONINSIGHTS_AUTHENTICATION_STRING — either by having _QuickpulseExporter also call _get_authentication_credential(**kwargs), or by having the distro resolve the credential once (e.g. add a _default_credential in _get_configurations()) and pass it consistently to every exporter it wires up, including QuickPulse.

Additional context

This is distinct from #37209 ("ClientAuthenticationError once Live Metrics is enabled", closed, fixed in exporter 1.0.0b29) — that issue was about Live Metrics having zero AAD support at all. Since b29, Live Metrics AAD works fine if a credential= object is passed explicitly to configure_azure_monitor(). This issue is narrower: the env-var-based AAD convention (APPLICATIONINSIGHTS_AUTHENTICATION_STRING), which is what Azure App Service/Functions' built-in "Application Insights Authentication type" feature relies on and which already works for every other exporter, is never propagated to the Live Metrics exporter. Verified this gap still exists on main as of 2026-07-24.