diff --git a/CHANGELOG.md b/CHANGELOG.md
index 617fa8a4..42963ebf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Common Changelog](https://common-changelog.org),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+
+- `azure/function_app_linux_managed_identity`: **Breaking** — require `azurerm ~> 4.66` (was `~> 3.117`) so the module accepts `dotnet_version = "10.0"`. Migrates the diagnostic setting's deprecated `metric` block to `enabled_metric` (removed in azurerm v5). Provider registration stays controlled by the `ARM_SKIP_PROVIDER_REGISTRATION` env var, which azurerm v4 still honours.
+
 ## [3.14.0] - 2024-08-15
 
 ### Added
diff --git a/modules/azure/function_app_linux_managed_identity/main.tf b/modules/azure/function_app_linux_managed_identity/main.tf
index 2b49e2f8..4e3fd931 100644
--- a/modules/azure/function_app_linux_managed_identity/main.tf
+++ b/modules/azure/function_app_linux_managed_identity/main.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     azurerm = {
       source  = "hashicorp/azurerm"
-      version = "~> 3.117"
+      version = "~> 4.66"
     }
     azuread = {
       source  = "hashicorp/azuread"
@@ -21,6 +21,9 @@ terraform {
 
 provider "azurerm" {
   features {}
+  # Provider registration stays disabled via the ARM_SKIP_PROVIDER_REGISTRATION env var the
+  # pipelines export (still honoured by azurerm v4). Do NOT also set resource_provider_registrations
+  # here: v4 rejects having both set at once.
 }
 
 provider "azapi" {
@@ -280,8 +283,7 @@ resource "azurerm_monitor_diagnostic_setting" "diagnostic_setting" {
     category_group = "allLogs"
   }
 
-  metric {
+  enabled_metric {
     category = "AllMetrics"
-    enabled  = true
   }
 }