I have been seeing the following failed operation in the Activity Log. Operation name Returns Storage Account SAS Token Event initiated by Windows Azure Application Insights Error code ResourceGroupNotFound Message Resource group 'Logs' could not be found. This started happening after I deleted the 'Logs' resource group and associated Storage account, but I cant find what Application Insight operation is causing it, I've check my VM's diagnostic settings and they use a valid resource, I also cant see anything under monitor.

@Tony Thank you for using the platform and working with our support team on the issue you had. Please feel free to revert back if you have any further queries. Surfacing the information so that it can help for broader community members. If the retention days are configured for the diagnostic logs sent to the storage account, it will result in back-end retention jobs to run in the background trying to access the storage account and generate the failed operation in the Activity Log. Once the retention period is passed, we should no longer receive these failed operations in the Activity Logs.

Returns Storage Account SAS Token

Tony 21

I have been seeing the following failed operation in the Activity Log.

Operation name Returns Storage Account SAS Token
Event initiated by Windows Azure Application Insights
Error code ResourceGroupNotFound
Message Resource group 'Logs' could not be found.

This started happening after I deleted the 'Logs' resource group and associated Storage account, but I cant find what Application Insight operation is causing it, I've check my VM's diagnostic settings and they use a valid resource, I also cant see anything under monitor.

bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-22T16:03:29.303+00:00
@Tony Welcome to Microsoft Q&A platform and thanks for using this forum.

'Returns Storage Account SAS Token' activity logs are generated usually when you configure a storage account to store diagnostic logs/application logs, application insights, Azure will try to get a SAS token first and then put the logs into it using the SAS token.

One possibility I could think of for the error you see is if any of the NSG flow logs is using the specific storage account. To isolate the issue

Try recreating the resource group and storage account.

Look for activity logs and check if you still see the errors and then validate the storage account blobs/containers for any NSG workflows.

If you find one, please go to NSG and look for NSG flow logs and try to reconfigure the flow with any other storage account.

Hope this information helps , please revert back if this doesn't solve your issue.
Tony 21 Reputation points

2020-08-23T13:28:02.68+00:00

After recreating the resource group and storage account the Operation is now successful, but I still can't find what is initiating it.
The storage account is empty, nothing in blobs/containers.
I only have a one NSG Flow log enabled, and that's linked to a different resource group and storage account.
bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-23T15:26:20.677+00:00

@Tony Thank you for your response and validating by recreating the RG and storage account, seems that this needs further troubleshooting. Can you please send an email to AzCommunity@microsoft.com with your Subscription details, JSON for both failed operation activity log and the recent successful ones and a link to this thread so we can verify and direct the request accordingly . We'll continue to investigate this with you directly and will update the thread with any findings that may help others. Thank you
Tony 21 Reputation points

2020-08-23T18:22:45.86+00:00

Email sent with details as requested, thanks for your assistance with this.
bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-23T22:54:42.197+00:00

@Tony Thank you for your email, will further review and get back to you on this thread.
bharathn-msft 5,096 Reputation points Microsoft Employee

2020-08-26T05:12:24.063+00:00

@Tony - I have sent you an email, please review it and circle back if you have any further queries. Thank you

Accepted answer

bharathn-msft 5,096 Reputation points Microsoft Employee

2020-09-02T23:33:01.583+00:00

@Tony Thank you for using the platform and working with our support team on the issue you had. Please feel free to revert back if you have any further queries.

Surfacing the information so that it can help for broader community members.

If the retention days are configured for the diagnostic logs sent to the storage account, it will result in back-end retention jobs to run in the background trying to access the storage account and generate the failed operation in the Activity Log. Once the retention period is passed, we should no longer receive these failed operations in the Activity Logs.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Returns Storage Account SAS Token

0 additional answers

Your answer