Most of the Application Insights resource menu was built for SDK-instrumented web apps and is empty for Copilot Studio. Five blades are worth your time, every investigation ends in the same pane, and here is the route to it.
Originally published at https://beyondtheprompt.dev/posts/application-insights-copilot-studio-navigation on 6 August 2026.
Someone hands you an Azure portal link and a ticket saying the agent gave a wrong answer at about three yesterday afternoon. The Application Insights resource opens on a menu of twenty-odd blades, and the reasonable thing to do is work down it. Failures is empty. Performance is empty. Live Metrics sits there streaming nothing at all, and Application Map draws a single box.
None of that is a fault. Almost all of that menu was built for an application you instrumented with an SDK, and Copilot Studio telemetry arrives by a different route: exported spans, custom events and traces rather than live-instrumented requests and exceptions. Five blades are worth opening, every route through them ends in the same pane, and the useful data is two scrolls down inside it. This is where to click, in the order that finds the answer fastest. The queries are in the companion piece on KQL for Copilot Studio telemetry.1
customEvents, environment-level writes to dependencies, and Microsoft recommends a separate resource for each.This is the map, and it is most of the value of the piece. The left column is the menu as the portal draws it. The right column is what it is worth to you on Copilot Studio work.
Fig. A - the resource menu, and what each entry is actually worth on Copilot Studio telemetry.
Five of them earn their place. Agents (Preview) is purpose-built for this telemetry and needs no KQL. Search is for eyeballing individual items when you have a name or an ID. Logs is for anything you want to count. Workbooks holds the prebuilt Copilot Studio dashboard. Alerts is how you stop hearing about outages from users.
The rest disappoint for reasons worth knowing, so you can say why rather than shrugging. Failures and Performance are built on requests and exceptions. Live Metrics streams from an SDK channel that is not in play. Application Map draws topology from dependency relationships that agent spans do not express. Availability is synthetic uptime tests you would have to write yourself.
Symptom: You tell a developer that Failures and Performance are empty for Copilot Studio, and they open them and find data.
Cause: Root invoke_agent spans may still land in the requests table until the environment-level rollout finishes globally, so during the transition those blades show a partial view rather than nothing.
Instead: Check your own resource before declaring a blade useless, and treat anything you do find there as incomplete rather than as the full picture.
The picker sits above Overview, Search, Failures, Performance, Logs and the Agents view, and it is the leading cause of “there is no data”: somebody left it on the last 30 minutes and the incident was yesterday. Widen it first when a result set is empty, then narrow it once you know the window, because a short range makes Search noticeably faster.
Symptom: A query with ago(7d) in it returns a few hours of data, and the numbers do not match what somebody else got from the same query.
Cause: In Logs, the time range picker overrides a time filter written in the KQL rather than intersecting with it.
Instead: Keep the two consistent, or set the picker to a wide range and let the query do the filtering, so there is one place that decides the window.
Whatever you have at the start, you finish in End-to-end transaction details. Only the way in differs, and the fastest one depends on what the ticket gave you.
Fig. D - four entry points, one destination. Choose by what you already have, not by what is nearest on the menu.
The shortcut worth memorising is View in Logs, in the top bar of Search, Failures and Performance. Point and click your way to roughly the right data, then press it and get the equivalent KQL, prefilled. Refining a generated query beats writing one from an empty editor, and it teaches you the schema on the way.
Azure Monitor’s agent observability is built on OpenTelemetry GenAI semantics, which is the shape environment-level Copilot Studio telemetry exports in, so this blade is the one part of the menu designed for the thing you are looking at.
Open the resource, then Agents (Preview). The landing view gives you tiles for agent runs, tool calls and models. Three ways in from there:
Each opens a Search overlay on the filtered traces, where you can sort by most tokens used to find the expensive operations and search prompt content, the latter only if conversation logging is on. Selecting a trace drops you into End-to-end transaction details, which is where the rest of this goes. Explore in Grafana in the top navigation opens prebuilt Azure Monitor GenAI dashboards, which is worth ten minutes if your platform team already lives there.
Tiles with non-zero counts, and a Gen AI Errors view that is either empty or holds the failures you came for. Tiles reading zero across a window you know had traffic means the export, not the agent.
When the ticket carries something specific, a conversation ID, an agent name, a fragment of an error string, Search finds it faster than writing a query does.
Fig. E - the Search view. The event types dropdown is the control people miss, and the one that decides whether anything comes back.
Reach the controls in this order. Time range first, then Event types, which is the single most important dropdown on the page and the one people skip:
| Your telemetry | Choose |
|---|---|
Environment-level, spans in dependencies | Dependency |
Agent-level, events in customEvents | Custom Event |
Real-time voice, rows in traces | Trace |
The other options exist for instrumented web apps and will be empty. Reset in the top bar restores the defaults when you have tangled the filters past recovery.
Free-text search then matches across every property value, with three rules that catch people out. It matches whole words rather than substrings, so home will not find HomeController.About but homecontroller will. Anything with special characters in it needs quoting. Boolean operators must be capitalised, and a lower-case and is treated as a search term.
Filter pills take a property, an operator (=, !=, contains, not contains) and one or more values. Look at the counts beside each value before committing to a filter: they say how many occurrences are in the current set, which is a frequency check you would otherwise have written a query for.
Symptom: A count taken from Search, Failures or Performance is lower than the same count from Logs, and somebody has already quoted the low one in a status update. Cause: Where sampling is in effect, those views and the transaction details pane show what survived sampling rather than everything that was emitted. Instead: Use these views to find an example and Logs to count, and never quote a figure taken from a blade that samples.
Also called transaction diagnostics. It renders one operation as a Gantt chart and lets you inspect every attribute of every span, which for Copilot Studio means a single agent turn: InvokeAgent, its ExecuteTool children and OutputMessages. There is no menu entry. The only way in is selecting a telemetry item somewhere else.
Fig. C - the four panes. The custom attributes at the bottom right of the details pane are what you came for.
The results list on the left holds the other results matching your filter. Items marked Suggested are picked because they are most likely to carry details from every component, so start with one of those rather than with the top row.
The transaction chart gives you one bar per span, and three things to read. Which bar dominates: if an ExecuteTool bar is most of the width, the problem is downstream rather than in the model. Gaps, which are time spent in something that is not a tracked dependency, and which are why the durations legitimately fail to add up. And rows that look duplicated, which are one call to another component appearing twice, as the outbound dependency and as the inbound request, told apart by the leading icon.
The time-sequence list underneath is a flat chronological list of everything in the transaction, custom events and traces included, which the Gantt does not draw. When a span looks missing from the chart, look here before concluding it was never emitted.
The details pane on the right is the point of the exercise. Show all expands the standard attributes; the custom attributes are listed separately below them, and that lower section is where everything useful for Copilot Studio lives: gen_ai.agent.name, gen_ai.conversation.id, gen_ai.tool.name, gen_ai.tool.call.arguments, gen_ai.tool.call.result, error.type and Status.message.
There is also a simple view, rendering the same transaction as a sequence of agent steps: agent invoked, model used, tools executed. For an agent turn it is usually the faster read, and Leave simple view returns you to the Gantt.
The most common ticket, click by click, because this is the path that gets walked most often.
error.type, Status.message, and gen_ai.tool.call.arguments against gen_ai.tool.call.result.Step seven is the answer to most tickets. What went into the tool, what came back, and what the platform thought the failure was.
A tool call whose arguments and result disagree with each other in an obvious way, or an error.type naming something outside the agent. If the custom attributes are all present but empty, the settings section below is why.
Everything Application Insights collects goes into Log Analytics, and Logs is how you query it. Cross this line as soon as the question becomes “how often”, “how many users” or “since when”.
Fig. B - the Logs workbench. The numbered controls are the ones worth learning; everything else can be found later.
There are two modes. Simple mode is a point-and-click, spreadsheet-like view with no Run button, where results refresh as you refine, and it is a good first look at an unfamiliar table. KQL mode is the query editor. Which opens by default is set under the tools menu, in Log Analytics settings.
In the top bar, Run is also Shift+Enter, Show is the result cap and defaults to 1000 rows, and the time range overrides your query as described above. In the sidebar, Tables is where you start: hover one for its description, expand it for columns, click it for a preview. Yours are dependencies, customEvents and traces. Query history keeps 30 days and 300 queries per user per resource, held per region as well, so two resources in different regions do not share it.
Symptom: A table you know should exist is missing from the sidebar, and it looks as though the workspace is misconfigured. Cause: Log Analytics hides empty tables by default, so a table with no data in it is absent rather than shown empty. Instead: Turn them on with Show tables with no data, next to the search bar for the session or in Log Analytics settings permanently, and read an empty-but-present table as the useful signal it is.
Symptom: You press Run and get the results of a query you were not looking at. Cause: A single tab can hold several queries separated by blank lines, and the one that runs is whichever contains the cursor. Instead: Click into the query you mean before running it, or keep one query per tab and use the plus button, which is cheap and removes the failure mode.
In the results grid, the chevron at the left of a row expands it, which is the fastest way to read a customDimensions blob. Headers sort and filter. Dragging a column onto the grouping bar groups by it, and grouping by agent or tool name is often quicker than rewriting the query. Chart brings up a formatting panel with a Split-by control, which gives one series per value: one line per agent.
Symptom: A chart flattens out or stops partway across the window, and it looks like the traffic stopped.
Cause: The result cap in Show, 1000 rows by default, truncates the result set before the chart is drawn from it.
Instead: Aggregate in the query with summarize so the row count is small and bounded, and raise the cap only when you genuinely need the individual rows.
The row of tools above the results is the part most people never open, and it is where a one-off investigation turns into something the team keeps. Save puts a query into a query pack shared with the team, saves it as a function, or pins it to a workbook or dashboard. Share copies a link to the query, its text or its results, or exports to Excel, CSV or Power BI. The tools menu holds New alert rule, which turns the query you just wrote into standing monitoring.
The function is the one worth the effort: a query saved as a function is callable by name from everybody else’s queries, which is how you stop five people maintaining five slightly different versions of “find this conversation”. Autosave quietly keeps tab names, queries, mode, scope and time range in browser local storage for 30 days, per browser and per resource, so a portal crash mid-investigation survives reopening Logs in the same browser.
Symptom: The same query returns different results for two people, or a table is unexpectedly full of telemetry from workloads you do not recognise. Cause: Opening Logs from the Application Insights resource scopes the query to that resource, while opening it from Azure Monitor or from a Log Analytics workspace scopes it to everything in the workspace. Instead: Check the scope indicator above the query window before you trust a result, and share query links from the resource rather than from the workspace so the recipient lands in the same place.
Open Workbooks under Monitoring and take Copilot Studio Dashboard from the gallery. It is a preview workbook over the same data, showing total conversations, latency, exceptions, tool usage and topic analytics in one view, and it opens editable. Edit in the command bar, then the menu on any element to change, move, clone or remove it, including adding a tile driven by your own KQL for a dimension the built-in view ignores. Save creates your own variant rather than overwriting theirs. Recipients need Reader on the resource.
Symptom: Somebody’s pinned tiles change or disappear without anyone touching their account. Cause: The Application dashboard, under Investigate, is shared by every user with access to the resource, so one person rearranging it rearranges it for all of them. Instead: Experiment on a personal or team Azure dashboard, or on a saved copy of the workbook, and leave the default Application dashboard alone.
Two toggles decided in Copilot Studio, not in Azure, determine whether the panes above hold anything interesting. Under Settings > Advanced > Application Insights:
| Setting | What it unlocks in the portal |
|---|---|
| Enable logging | Incoming and outgoing messages and events appear at all |
| Log conversation details | User ID, user name and message text, and with tracing on, tool input arguments and tool output results in spans |
| Log sensitive Activity properties | Values of properties considered sensitive on messages and events |
| Node execution events | One event per node execution within a topic, which is what step-level timing needs |
This is a genuine trade-off, not a checkbox to tick on the way past. Without conversation details you cannot read prompts, tool arguments or tool results in the details pane, which removes most of the value of the transaction view. With it, user message content lands in Application Insights and inherits that resource’s retention and access model, which is a different conversation with a different set of people. Decide it deliberately, and write down who decided it.
Symptom: The custom attributes in the details pane are all present but empty, and the transaction view is technically working and practically useless. Cause: Tool arguments and results are only written into spans when Log conversation details is enabled on the agent. Instead: Check the Copilot Studio setting before you raise anything against the telemetry pipeline, since an empty attribute and an absent one look identical in the portal.
When nothing is there at all, in this order, and only then raise it with somebody:
dependencies and customEvents exist but are empty, or are not there at all. Those are different problems.Both the Agents view and environment-level export are in preview and rolling out globally, so the layout moves. When a control is not where this says it is, it has almost certainly been renamed or relocated rather than removed. That is also why bookmarking the resource beats bookmarking the blade: a deep link to a preview blade dies when somebody renames it, and the resource link survives.
The other thing that catches people is treating this as a normal Azure workload one more time, after already learning that it is not. Failures being empty is not an incident. A tool call taking most of the transaction is not a model problem. A clean green line on a native success column is not evidence of anything at all, which is the finding the KQL companion spends most of its length on.
Two tabs, in practice. The Agents blade filtered to Gen AI errors, and a Logs tab with a couple of saved queries in it. Everything else gets opened when there is a reason and closed afterwards.
The habits matter more than the blades. Start from what the ticket actually gave you rather than from the top of the menu, because the four on-ramps exist precisely so you do not have to guess. Send a query link instead of a screenshot, since a screenshot of a result set is somewhere a conversation goes to die and a link is something the other person can modify. Promote a query to a workbook only after running it by hand enough times to trust it, and put an alert on it only once you know how often it cries wolf.
The compromise worth naming is that most of this is a preview interface described in a fixed document, and the two will drift. The click paths have held up better than the layouts so far, which is why they are written as paths rather than as pictures of a screen. When something does not match, the schema discovery queries in the companion piece will tell you what is really there faster than the portal will.
Checked against the Microsoft Learn Application Insights and Copilot Studio documentation on 6 August 2026. Both the Agents view and environment-level Copilot Studio telemetry were in preview at that point, and preview interfaces move. The figures are original schematics rather than screenshots, drawn to survive a portal redesign that a capture would not.