Access to tracing requires both tenant entitlement and user permissions. A user with a tracing permission still cannot access trace APIs if Trace Monitoring is not enabled for the tenant.

Tenant entitlement

The client must have Trace Monitoring enabled before users can access tracing. If trace views or setup instructions are unavailable, ask the client administrator to confirm entitlement and role permissions.

Permissions

PermissionTypical Access
TRACE_VIEWView trace services, operations, spans, topology, insights, labels, ingestion settings, and retention settings.
TRACE_MANAGECreate, change, or delete ingestion limits and perform supported management operations such as deleting retention policies.
ADMINISTRATIONCreate trace retention policies. This permission is intentionally stricter than viewing or deleting a policy.
INTEGRATION_VIEWUsed with Trace View when reading trace integration and application content.
INTEGRATION_MANAGEAccess restricted collection and trace-proxy configuration steps in the observability UI workflow.
ALERTS_VIEWView trace alert panels and ingestion warning or critical notifications.

Common role patterns

  • Observer or operator: Trace Monitoring entitlement plus TRACE_VIEW.
  • Tracing administrator: TRACE_VIEW and TRACE_MANAGE; add ADMINISTRATION when retention policies must be created.
  • Integration administrator: tracing permissions plus INTEGRATION_MANAGE for restricted collector and proxy setup content in the observability UI.
  • Alert consumer: tracing access plus ALERTS_VIEW for trace alert surfaces and ingestion-limit notifications in the observability UI.

Actual role names are tenant-specific; assign the underlying permissions according to least privilege.

Access checks

  1. Select the intended client and sign in with an authorized account.
  2. Confirm that Trace Monitoring is enabled for that client.
  3. Ask the administrator to grant only the permissions needed for your tasks.

For service-to-service ingestion, use the credentials and tenant context defined by the chosen exporter, collector, or gateway configuration. Do not embed long-lived credentials in application source code.