Azure Monitor Alert execution log
I know there is a Monitor | Alerts page that shows those alerts that have been "Fired" as they alert query has met the criteria configured for the alert, but is there a log or page that shows all of the executions of the alert rule that shows…
Azure Monitor
Packaging Data Collection Components for Azure Sentinel Solutions: DCEs, DCRs, and Custom Logs
I need guidance on packaging Data Collection Endpoints (DCEs), Data Collection Rules (DCRs), and custom logs, as they aren't directly under Sentinel resources. How can I effectively include these components within my solution for proper deployment and…
Azure Monitor
Azure Diagnostics settings reappearing after deletion, for some of the NSGs
We’ve recently migrated a subscription from one tenant to another. After the move, a diagnostic setting continues to reappear on certain network resources—even after manual deletion. We’ve investigated the following: There are no active policy…
Azure Monitor
Which resources require workspace key to connect to Log Analytics workspaces ?
Hello, I was just wondering which resources require the use of a workspace key to connect to a log analytics workspace? currently I know that VMs, containers and DevOps can use such a connection. However I was wondering if anyone knew of a concrete list…
Azure Monitor
Not able to uninstall MMA extension on Azure Virtual silver peaks
Not able to uninstall MMA extension on Azure Virtual silver peaks
Azure Monitor
Where can we find the updates regarding Azure Monitor Diagnostics support for Mobile app
Since Azure Monitor is implementing mobile app support for mobile analytics and diagnostics, where can we find updated regarding any timeline or release plan if the implementation?
Azure Monitor
Discrepancies in Azure Activity Logs Schema and EventDataId Field between Event Hub and Log Analytics Workspace
Hello, We are currently forwarding Azure Activity Logs from Azure Monitor using Diagnostic Settings to both an Event Hub and a Log Analytics Workspace. We have observed some discrepancies that we would like to clarify: The schema of the logs received in…
Azure Monitor

How to use authentication for Prometheus adapter so that it can fetch metrics from Azure Monitor Workspace?
Hello I have enabled Azure managed Prometheus and set up workspace. Now I want to do scaling of pods using HPA on a custom metrics, for which I have deployed the https://github.com/kubernetes-sigs/prometheus-adapter. I have enabled workload identity in…
Azure Monitor
How to interpret the OriginHealthPercentage metric values in Log Analytics Workspace
It seems as though there might be a bug in the export of the OriginHealthPercentage metric of a Premium Front Door to a Log Analytics Workspace. When graphed in Azure Metrics at a one minute interval to match the PT1M granularity in the Log Analytics…
Azure Monitor

Log analytics workspace archive restore data not working
Hi, I'm trying to access data older than 1 month from a Log Analytics Workspace where the total retention period is as follows: I've been following this guide from MS docs: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/restore?tabs=api-1 …
Azure Monitor
Settings in mdsd.xml ignored by azure monitor agent
I have relatively small disks which are constantly filled by Azure Monitor Agent. After configuring 7 days and max 100MB logs in mdsd.xml, <Management eventVolume="Large" defaultRetentionInDays="7" > <AgentResourceUsage…
Azure Monitor
Set log analytics workspace in ASE for all app services
Hi I have 30 app services within a single ASE. Previously, each app service had its own dedicated Application Insights instance. However, after Microsoft’s classic app service migration, we are now required to create a Log Analytics workspace as…
Azure Monitor
Unable to remove auto-created Data Collection Endpoint in Azure, error "AuthorizationFailed : Operation not allowed"
I created a Log Analytics Workspace in Azure and enabled replication to another region. When replication is enabled, Azure automatically creates a Data Collection Endpoint (DCE). There was no Azure Monitoring Private Link Scope used and no Data…
Azure Monitor

How do collection rules work in Microsoft Sentinel for filtering Windows Event IDs?
Hi everyone, I'm trying to better understand how collection rules work in Microsoft Sentinel when ingesting Windows security events. For now, I receive all the Windows security events because I created a rule that is set up to "AllEvents" (as…
Azure Monitor
How does azure calculate billing for azure log analytics workspace.
Hello Team, I’ve recently observed a significant spike in my Azure billing, specifically related to the Log Analytics workspace. A large volume of logs has started ingesting unexpectedly, primarily from Azure-managed resources. Most of this data appears…
Azure Monitor
DCR based custom tables are not working
Hello All, I have a Linux server vm in Azure as my syslog server. My Meraki MX devices are sending logs to the syslog server into their individual folders, and they are flowing. I used to have custom logs in Azure Log Analytics that pulls these logs…
Azure Monitor
We need the cost estimation for azure managed grafana for cluster monitoring.
We have currently using AKS we need the monitoring enabled from Grafana also we need the logging we currently storing the application logs in azure file shares which are running in the same cluster we want to access those logs from storage account. so…
Azure Monitor
Need help to correct my KQL in Azure
I have created below KQL for APP to get the login count but output always coming as 0, I need help what to update here: AuditLogs | where AdditionalDetails contains "B2C_1A_RPBT_SignIn" //| where LoggedByService == "B2C" and…
Azure Monitor
API keys for querying data from Azure Monitor application insights will be retired
We received an email with the following title: API keys for querying data from Azure Monitor application insights will be retired on 31 March 2026 — transition to using Azure AD. We're currently using connection strings when sending data to Application…
Azure Monitor
Unable to run query in log analytics workspace
Hi, I was trying to run some queries to fetch some logs in my log analytics workspace. I am simply trying with queries like "perf" or a query to get the heartbeat of a VM, and its showing the below errors respectively: '' operator: Failed…