Exporting telemetry from Collector to Azure Event Hub using Managed Identity?

[mikkelh-SDU]

Hey OpenTelemetry community 👋

I’m trying to design a telemetry pipeline in Azure and I’m struggling to find a clean and secure way to export from the OpenTelemetry Collector to Azure Event Hub.

Below is the full architecture for context:

flowchart LR
    %% ===== Applications =====
    WA["Azure Web Apps"]

    %% ===== Telemetry Pipeline =====
    COL["OpenTelemetry Collector"]

    %% ===== Messaging =====
    EH["Azure Event Hub"]

    %% ===== Processing =====
    FA["Azure Function App<br/>(Event Hub Trigger)"]

    %% ===== Observability =====
    EL["Elastic OTLP Endpoint"]

    %% ===== Flow =====
    WA -- "OTLP (gRPC/HTTP)" --> COL
    COL -- "Export" --> EH
    EH -- "Event Trigger" --> FA
    FA -- "OTLP Export" --> EL

Loading

Goal

I want to:

• Send logs, metrics, and traces from Azure Web Apps to an OpenTelemetry Collector.
• Export the telemetry from the Collector to Azure Event Hub.
• Let an Azure Function (Event Hub trigger) process and forward the data to an Elastic OTLP endpoint.

The main reason for using Azure Event Hub is fan-out.

We want Event Hub to act as a central event backbone, so multiple consumers can subscribe to the same telemetry stream (e.g., Elastic, internal analytics pipelines, security tooling, etc.). In other words, Event Hub is intentional — not just an intermediate hop.

All components are hosted inside Azure.

---

The challenge

From what I can see:

• There is no native Azure Event Hub exporter in otel/opentelemetry-collector-contrib.
• Azure Event Hubs provides a Kafka-compatible endpoint.
• I could use the Kafka exporter in the Collector.
• However, this requires SASL + connection string (SAS keys).

In our environment, using SAS keys is discouraged. Since all resources (WebApp, Collector, Event Hub, Function App) are running in Azure, I would strongly prefer using Azure AD / Managed Identity for authentication.

What I’m trying to understand

• Is using the Kafka exporter with SAS keys the only supported option today?
• Is there any exporter that supports Azure AD authentication for Event Hubs?
• Is writing a custom exporter the intended approach?
• Or is Azure Event Hub simply not a recommended backend target for OpenTelemetry Collector?

I’m mainly trying to understand what the intended or recommended architecture is when Azure Event Hub is used as a fan-out backbone for telemetry.

Any guidance, architectural patterns, or references would be greatly appreciated

---

I used AI assistance to help structure this post due to dyslexia — I hope the question is clear. If anything needs clarification, I’m happy to elaborate.