diff --git a/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2021-03-03-preview/diagnosticServicesToken_API.json b/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2021-03-03-preview/diagnosticServicesToken_API.json
new file mode 100644
index 000000000000..fb6feeac1045
--- /dev/null
+++ b/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2021-03-03-preview/diagnosticServicesToken_API.json
@@ -0,0 +1,134 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "ApplicationInsightsManagementClient",
+    "description": "Azure Application Insights client for application insights diagnostic services token.",
+    "version": "2021-03-03-preview"
+  },
+  "host": "management.azure.com",
+  "schemes": [
+    "https"
+  ],
+  "consumes": [
+    "application/json"
+  ],
+  "produces": [
+    "application/json"
+  ],
+  "security": [
+    {
+      "azure_auth": [
+        "user_impersonation"
+      ]
+    }
+  ],
+  "securityDefinitions": {
+    "azure_auth": {
+      "type": "oauth2",
+      "authorizationUrl": "https://login.microsoftonline.com/common/oauth2/authorize",
+      "flow": "implicit",
+      "description": "Azure Active Directory OAuth2 Flow.",
+      "scopes": {
+        "user_impersonation": "impersonate your user account"
+      }
+    }
+  },
+  "paths": {
+    "/{resourceUri}/providers/Microsoft.Insights/generateDiagnosticServiceReadOnlyToken": {
+      "post": {
+        "tags": [
+          "generateDiagnosticServiceReadOnlyToken"
+        ],
+        "operationId": "DiagnosticServiceToken_GetReadOnly",
+        "description": "Gets an read-only access token for application insights diagnostic service data.",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ResourceUriParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/ApiVersionParameter"
+          }
+        ],
+        "responses": {
+          "default": {
+            "description": "Error response describing why the operation failed .",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v2/types.json#/definitions/ErrorResponse"
+            }
+          },
+          "200": {
+            "description": "Successful response containing the application insights diagnostic services token.",
+            "schema": {
+              "$ref": "#/definitions/DiagnosticServicesTokenResponse"
+            }
+          }
+        },
+        "x-ms-examples": {
+          "Get diagnostic services read-only token for resource": {
+            "$ref": "./examples/DiagnosticServicesReadOnlyTokenPost.json"
+          }
+        }
+      }
+    },
+    "/{resourceUri}/providers/Microsoft.Insights/generateDiagnosticServiceReadWriteToken": {
+      "post": {
+        "tags": [
+          "generateDiagnosticServiceReadWriteToken"
+        ],
+        "operationId": "DiagnosticServiceToken_GetReadWrite",
+        "description": "Gets an read-write access token for application insights diagnostic service data.",
+        "parameters": [
+          {
+            "$ref": "#/parameters/ResourceUriParameter"
+          },
+          {
+            "$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/ApiVersionParameter"
+          }
+        ],
+        "responses": {
+          "default": {
+            "description": "Error response describing why the operation failed .",
+            "schema": {
+              "$ref": "../../../../../common-types/resource-management/v2/types.json#/definitions/ErrorResponse"
+            }
+          },
+          "200": {
+            "description": "Successful response containing the application insights diagnostic services token.",
+            "schema": {
+              "$ref": "#/definitions/DiagnosticServicesTokenResponse"
+            }
+          }
+        },
+        "x-ms-examples": {
+          "Get diagnostic services read-write token for resource": {
+            "$ref": "./examples/DiagnosticServicesReadWriteTokenPost.json"
+          }
+        }
+      }
+    }
+  },
+  "definitions": {
+    "DiagnosticServicesTokenResponse": {
+      "type": "object",
+      "properties": {
+        "token": {
+          "x-ms-secret": true,
+          "type": "string",
+          "description": "JWT token for accessing application insights diagnostic service data."
+        }
+      },
+      "description": "The response to a diagnostic services token query."
+    }
+  },
+  "parameters": {
+    "ResourceUriParameter": {
+      "name": "resourceUri",
+      "in": "path",
+      "required": true,
+      "type": "string",
+      "description": "The identifier of the resource.",
+      "x-ms-parameter-location": "method",
+      "x-ms-skip-url-encoding": true
+    }
+  }
+}
diff --git a/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2021-03-03-preview/examples/DiagnosticServicesReadOnlyTokenPost.json b/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2021-03-03-preview/examples/DiagnosticServicesReadOnlyTokenPost.json
new file mode 100644
index 000000000000..128e9d9f65bd
--- /dev/null
+++ b/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2021-03-03-preview/examples/DiagnosticServicesReadOnlyTokenPost.json
@@ -0,0 +1,13 @@
+{
+  "parameters": {
+    "resourceUri": "subscriptions/df602c9c-7aa0-407d-a6fb-eb20c8bd1192/resourceGroups/FabrikamFiberApp/providers/microsoft.insights/components/CustomAvailabilityTest/",
+    "api-version": "2021-03-03-preview"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
+      }
+    }
+  }
+}
diff --git a/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2021-03-03-preview/examples/DiagnosticServicesReadWriteTokenPost.json b/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2021-03-03-preview/examples/DiagnosticServicesReadWriteTokenPost.json
new file mode 100644
index 000000000000..128e9d9f65bd
--- /dev/null
+++ b/specification/applicationinsights/resource-manager/Microsoft.Insights/preview/2021-03-03-preview/examples/DiagnosticServicesReadWriteTokenPost.json
@@ -0,0 +1,13 @@
+{
+  "parameters": {
+    "resourceUri": "subscriptions/df602c9c-7aa0-407d-a6fb-eb20c8bd1192/resourceGroups/FabrikamFiberApp/providers/microsoft.insights/components/CustomAvailabilityTest/",
+    "api-version": "2021-03-03-preview"
+  },
+  "responses": {
+    "200": {
+      "body": {
+        "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
+      }
+    }
+  }
+}
diff --git a/specification/applicationinsights/resource-manager/readme.md b/specification/applicationinsights/resource-manager/readme.md
index b4532edb0ce1..0f95a970a1a7 100644
--- a/specification/applicationinsights/resource-manager/readme.md
+++ b/specification/applicationinsights/resource-manager/readme.md
@@ -201,8 +201,21 @@ directive:
     reason: 'get workbook list by subscription is not supported'
   - suppress: OperationsAPIImplementation
     reason: 'Previously implemented operation apis are using an incorrect RP case format which I cannot change.'
+  - suppress: SECRET_PROPERTY
+    from: diagnosticServicesToken_API.json
+    where:
+      - $.definitions.DiagnosticServicesTokenResponse.properties.token
+    reason: 'Secrets are OK to return in a POST response.'
 ```
 
+### Tag: package-preview-2021-03-only
+
+These settings apply only when `--tag=package-preview-2021-03-only` is specified on the command line.
+
+```yaml $(tag) == 'package-preview-2021-03-only'
+input-file:
+  - Microsoft.Insights/preview/2021-03-03-preview/diagnosticServicesToken_API.json
+```
 ### Tag: package-2020-02-12
 
 These settings apply only when `--tag=package-2020-02-12` is specified on the command line.