diff --git a/pkg/tsdb/azuremonitor/azuremonitor.go b/pkg/tsdb/azuremonitor/azuremonitor.go
index 151d9122ba1..24836ac0828 100644
--- a/pkg/tsdb/azuremonitor/azuremonitor.go
+++ b/pkg/tsdb/azuremonitor/azuremonitor.go
@@ -266,7 +266,10 @@ func checkAzureMonitorResourceGraphHealth(dsInfo types.DatasourceInfo) (*http.Re
 func (s *Service) CheckHealth(ctx context.Context, req *backend.CheckHealthRequest) (*backend.CheckHealthResult, error) {
 	dsInfo, err := s.getDSInfo(req.PluginContext)
 	if err != nil {
-		return nil, err
+		return &backend.CheckHealthResult{
+			Status:  backend.HealthStatusError,
+			Message: err.Error(),
+		}, nil
 	}
 
 	status := backend.HealthStatusOk
diff --git a/pkg/tsdb/azuremonitor/credentials.go b/pkg/tsdb/azuremonitor/credentials.go
index be155b764ee..b60b3733467 100644
--- a/pkg/tsdb/azuremonitor/credentials.go
+++ b/pkg/tsdb/azuremonitor/credentials.go
@@ -109,6 +109,9 @@ func getAzureCredentials(cfg *setting.Cfg, jsonData *simplejson.Json, secureJson
 		if err != nil {
 			return nil, err
 		}
+		if secureJsonData["clientSecret"] == "" {
+			return nil, fmt.Errorf("unable to instantiate credentials, clientSecret must be set")
+		}
 		credentials := &azcredentials.AzureClientSecretCredentials{
 			AzureCloud:   cloud,
 			TenantId:     jsonData.Get("tenantId").MustString(),
diff --git a/pkg/tsdb/azuremonitor/credentials_test.go b/pkg/tsdb/azuremonitor/credentials_test.go
index 35fb2ebfb9f..61f3ecb22d9 100644
--- a/pkg/tsdb/azuremonitor/credentials_test.go
+++ b/pkg/tsdb/azuremonitor/credentials_test.go
@@ -197,5 +197,13 @@ func TestCredentials_getAzureCredentials(t *testing.T) {
 			// Azure Monitor datasource doesn't support custom IdP authorities (Authority is always empty)
 			assert.Equal(t, "", clientSecretCredentials.Authority)
 		})
+
+		t.Run("should error if no client secret is set", func(t *testing.T) {
+			cfg := &setting.Cfg{}
+			_, err := getAzureCredentials(cfg, jsonData, map[string]string{
+				"clientSecret": "",
+			})
+			require.ErrorContains(t, err, "clientSecret must be set")
+		})
 	})
 }
diff --git a/pkg/tsdb/azuremonitor/httpclient.go b/pkg/tsdb/azuremonitor/httpclient.go
index 12a483810ab..bd0173eec52 100644
--- a/pkg/tsdb/azuremonitor/httpclient.go
+++ b/pkg/tsdb/azuremonitor/httpclient.go
@@ -1,8 +1,10 @@
 package azuremonitor
 
 import (
+	"fmt"
 	"net/http"
 
+	"github.com/grafana/grafana-azure-sdk-go/azcredentials"
 	"github.com/grafana/grafana-azure-sdk-go/azhttpclient"
 	sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
 
@@ -18,6 +20,9 @@ func newHTTPClient(route types.AzRoute, model types.DatasourceInfo, cfg *setting
 
 	// Use Azure credentials if the route has OAuth scopes configured
 	if len(route.Scopes) > 0 {
+		if cred, ok := model.Credentials.(*azcredentials.AzureClientSecretCredentials); ok && cred.ClientSecret == "" {
+			return nil, fmt.Errorf("unable to initialize HTTP Client: clientSecret not found")
+		}
 		azhttpclient.AddAzureAuthentication(&opts, cfg.Azure, model.Credentials, route.Scopes)
 	}
 
diff --git a/public/app/plugins/datasource/grafana-azure-monitor-datasource/credentials.ts b/public/app/plugins/datasource/grafana-azure-monitor-datasource/credentials.ts
index e92905fb035..c7f73be3795 100644
--- a/public/app/plugins/datasource/grafana-azure-monitor-datasource/credentials.ts
+++ b/public/app/plugins/datasource/grafana-azure-monitor-datasource/credentials.ts
@@ -152,10 +152,7 @@ export function updateCredentials(
         },
         secureJsonData: {
           ...options.secureJsonData,
-          clientSecret:
-            typeof credentials.clientSecret === 'string' && credentials.clientSecret.length > 0
-              ? credentials.clientSecret
-              : undefined,
+          clientSecret: typeof credentials.clientSecret === 'string' ? credentials.clientSecret : undefined,
         },
         secureJsonFields: {
           ...options.secureJsonFields,