I wonder what would be safe way for publicly available mobile app that signs users in with oauth 2.0 (PKCE used) and Azure B2C to collect insight data directly to Azure Application Insight (not via app server). Connection string would be too vulnerable to hold inside the app. Ideally only signed in via B2C users should be allowed to submit data.

I've found this article, but firstly not sure if Monitoring Metrics Publisher role could be assigned to the app registration, seems like need to be assigned to every signed up person. Secondly the code does not demonstrate how to handle it in prod, from what I ca see would work only under local debugging with DefaultAzureCredential.