Insufficient permissions when I click on Log Analytics or Workbooks

Question

Insufficient permissions when I click on Log Analytics or Workbooks

Ludwig Wurmannstätter 25

I'm in the Entra Admin Center under Monitoring & health and click on Workbooks I get an error saying "Insufficient permissions" and then showing me this (Subscription-ID cc01... is changed, this is not the one that is shown in the real error):

"In order for you to be able to leverage Log Analytics or Workbooks you first need to get permission for one of the following workspaces: /subscriptions/cc01cae4-1e4d-16a5-b331-1076320570b1/resourcegroups/aip-log-analytics-rg/providers/microsoft.operationalinsights/workspaces/aip-log-analytics-instance, /subscriptions/cc01cae4-1e4d-16a5-b331-1076320570b1/resourcegroups/ca-log-analytics-instance_rg/providers/microsoft.operationalinsights/workspaces/ca-log-analytics-instance"

I don't have that Subscription in my Tenant, nor in other Tenants I own for testing purposes, nor can I find the shown Ressource groups.

As all that is testing playground, I can't say for sure that the one or the other Subscription was used and is now deleted. But checking with the PS cmd Get-AzSubscription -TenantId here-comes-my-tenant-id it only shows one Subscription and not the one mentioned above in the error.

I even created a new Log Analytics Workspace with a new Workbook connected, but the error stays.

What else can I do to get Entra Monitoring up and running?

Greetings, Ludwig

Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-13T10:44:03.6133333+00:00

Hi Ludwig Wurmannstätter

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

check your account has the right permissions. You need the "Reports Reader" role to see monitoring features in Entra. If you don’t have it, ask your administrator for help.

Make sure you're logged into the right Azure tenant where your subscriptions are. You can run the PowerShell command:

Get-AzSubscription -TenantId <your-tenant-id> to see all subscriptions in your tenant.

If you created a new Log Analytics workspace and still see the error, check that it is properly configured and that your account has the necessary access.

Go to the Azure portal and open the Log Analytics workspaces section. Verify if your user has been assigned any roles related to these workspaces.

If you think the resources were used before but might have been deleted, check the Azure Activity log for any deletion events that show changes to the resources.

If nothing else works, contact Microsoft support for help with permissions and workspace access issues.

For reference, please review this documentation: -
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-data-freshness
https://learn.microsoft.com/fr-fr/troubleshoot/entra/entra-id/user-prov-sync/outdate-information-displays
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-use-health-scenario-alerts

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Ludwig Wurmannstätter 25 Reputation points

2024-11-13T14:45:37.4766667+00:00

Hi Pranay Reddy,

first of all I'm the Global Admin and I have the Reports reader role. As I mentioned in my Question, the Problem is the Error message mentions a unknown Subscription.
The Get-AzSubscription command shows only one Subscription in this Tenant, and it's not the number shown in the message.

Any other hints?

Ludwig
Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-13T16:41:59+00:00

Hi Ludwig Wurmannstätter

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Even as a Global Admin with the Reports Reader role, make sure you have the right permissions for the Log Analytics workspaces listed in the error. You need either the Log Analytics Reader or Log Analytics Contributor role for those workspaces.

You can use PowerShell commands to view all Log Analytics workspaces linked to your subscription:

Get-AzOperationalInsightsWorkspace -ResourceGroupName <YourResourceGroupName>

Replace <YourResourceGroupName> with the name of your resource group. This will check if the workspaces mentioned in the error exist or if there are any issues.

If the Get-AzSubscription command shows only one subscription, make sure you're logged into the correct Azure tenant where your subscriptions are. You can switch tenants using:

Connect-AzAccount -TenantId <YourTenantId>

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Ludwig Wurmannstätter 25 Reputation points

2024-11-13T20:38:42.9133333+00:00

Hi @Pranay Reddy Madireddy ,

I know of 5 Tenants where I'm an admin.
I logged in to every single Tenant with my tenant admin as well as the ******@MyDomainName.onmicrosoft.com Account and double checked the Subscriptions. I was unable to see the subscription mentioned in the Error.

Let's assume this is an Subscription I previously had in my Tenant and I deleted it. Is there a way to see and maybe reactivate it? The deletion could be old, maybe 2 or more years :-|
Ludwig Wurmannstätter 25 Reputation points

2024-11-13T21:04:16.05+00:00

Hi @Pranay Reddy Madireddy ,

I think I found a possible explanation --> still doesn't solve the problem.

When I worked for Microsoft this Tenant had e.g., Office 365 IUR (Internal Use Rights) Licenses on it. When I left the company, these Licenses where removed and so where the Subscriptions with all the Content within the Subscription (all Resource groups, Workspaces. ...).

When I now click on Log Analytics in Entra, it seems there is an "old connection".
So the Question now is "how can I reset Entra in a way to start from scratch?"
Ludwig Wurmannstätter 25 Reputation points

2024-11-13T21:25:49.5833333+00:00

deleted
Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-14T18:27:40.82+00:00

Hi Ludwig Wurmannstätter
Once the workspace is deleted, you can create a new one by clicking the "Add" button in the toolbar at the top of the page. When creating a new Log Analytics workspace, ensure that you select the correct subscription and resource group. After the new workspace is created, you can begin using it to collect and analyze data.

thanks
Pranay
Ludwig Wurmannstätter 25 Reputation points

2024-11-15T07:51:44.62+00:00

but how can I delete a Workspace from a Subscription I'm no longer have or even see in my Tenant? Do you know of an PowerShell or GraphAPI command I can use?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-15T21:15:19.4333333+00:00

Hi Ludwig Wurmannstätter
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Ludwig Wurmannstätter 25 Reputation points

2024-11-15T22:24:23.04+00:00

Hi @Pranay Reddy Madireddy ,

I have no idea why my last post was deleted, except I had two images / results from PowerShell in it.
I'll try to answer in words and not with screenshots.
Your answer with the PS commands have been really helpful, both of them just gave me an error saying I can't set the context to something and later remove something that is not available in my Tenant.

At the end, if we are unable to see and deleted stuff Entra is trying to use, in this case a Subscription and a Workbook, we can do nothing to solve the issue.

Right?
Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-18T22:32:26.5233333+00:00

Hi Ludwig Wurmannstätter

Check that you're using the correct Azure subscription. Run this PowerShell command to see all subscriptions linked to your account:

Get-AzSubscription

Check that the Log Analytics workspace is in the subscription you're using.

If there’s no Log Analytics workspace in the subscription, you can create a new one using the Azure portal or PowerShell.

New-AzOperationalInsightsWorkspace -ResourceGroupName "<YourResourceGroup>" -Name "<YourWorkspaceName>" -Location "<YourLocation>" -Sku "PerGB2018"

If you prefer the command line, you can use Azure CLI to check for existing workspaces or create a new one.

az monitor log-analytics workspace list --resource-group <YourResourceGroup>

To create a new workspace:

az monitor log-analytics workspace create --resource-group <YourResourceGroup> --workspace-name <YourWorkspaceName> --location <YourLocation>

If a workspace was recently deleted, it might still be in a soft-delete state. Check if there are any soft-deleted workspaces in your subscription.

thanks
Pranay
Ludwig Wurmannstätter 25 Reputation points

2024-11-19T09:48:21.72+00:00

Hi Pranay,

thanks for the answer. I really carefully checked all my Subscriptions. But the one mentioned in the Entra Monitoring & health error message is not listed. And as I said, very likely that was one I deleted long time ago.

So I created a new Log Analytics workspace with PowerShell as you described. Btw. thanks for that very good and detailed description. Running the az command to list all workspaces and see it, looking at it in the Azure Portal I have it.

Lastly I checked my Roles on that Log Analytics workspace, inherited I'm a Service Administrator and directly given I'm a Log Analytics Contributor. I waited for some hours and then I checked again in Entra.

But back in the Entra Portal when I click on Log Analytics in Monitoring & health it still shows the error with the missing subscription ID. Entra does not pick up the newly created one.

From my point of view Entra simply picked up something really old and I'm unable to convince Entra to forget all that old stuff and pick up the new ones.

I will open a case with Microsoft.

I would like to say thank you to you, you've been such a valuable helping hand, but I think both of us are at the end of what we can do.

Answer accepted by question author

0 additional answers

Your answer

Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-13T10:44:03.6133333+00:00

Hi Ludwig Wurmannstätter

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

check your account has the right permissions. You need the "Reports Reader" role to see monitoring features in Entra. If you don’t have it, ask your administrator for help.

Make sure you're logged into the right Azure tenant where your subscriptions are. You can run the PowerShell command:

Get-AzSubscription -TenantId <your-tenant-id> to see all subscriptions in your tenant.

If you created a new Log Analytics workspace and still see the error, check that it is properly configured and that your account has the necessary access.

Go to the Azure portal and open the Log Analytics workspaces section. Verify if your user has been assigned any roles related to these workspaces.

If you think the resources were used before but might have been deleted, check the Azure Activity log for any deletion events that show changes to the resources.

If nothing else works, contact Microsoft support for help with permissions and workspace access issues.

For reference, please review this documentation: -
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-health-data-freshness
https://learn.microsoft.com/fr-fr/troubleshoot/entra/entra-id/user-prov-sync/outdate-information-displays
https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-use-health-scenario-alerts

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Ludwig Wurmannstätter 25 Reputation points

2024-11-13T14:45:37.4766667+00:00

Hi Pranay Reddy,

first of all I'm the Global Admin and I have the Reports reader role. As I mentioned in my Question, the Problem is the Error message mentions a unknown Subscription.
The Get-AzSubscription command shows only one Subscription in this Tenant, and it's not the number shown in the message.

Any other hints?

Ludwig
Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-13T16:41:59+00:00

Hi Ludwig Wurmannstätter

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Even as a Global Admin with the Reports Reader role, make sure you have the right permissions for the Log Analytics workspaces listed in the error. You need either the Log Analytics Reader or Log Analytics Contributor role for those workspaces.

You can use PowerShell commands to view all Log Analytics workspaces linked to your subscription:

Get-AzOperationalInsightsWorkspace -ResourceGroupName <YourResourceGroupName>

Replace <YourResourceGroupName> with the name of your resource group. This will check if the workspaces mentioned in the error exist or if there are any issues.

If the Get-AzSubscription command shows only one subscription, make sure you're logged into the correct Azure tenant where your subscriptions are. You can switch tenants using:

Connect-AzAccount -TenantId <YourTenantId>

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Ludwig Wurmannstätter 25 Reputation points

2024-11-13T20:38:42.9133333+00:00

Hi @Pranay Reddy Madireddy ,

I know of 5 Tenants where I'm an admin.
I logged in to every single Tenant with my tenant admin as well as the ******@MyDomainName.onmicrosoft.com Account and double checked the Subscriptions. I was unable to see the subscription mentioned in the Error.

Let's assume this is an Subscription I previously had in my Tenant and I deleted it. Is there a way to see and maybe reactivate it? The deletion could be old, maybe 2 or more years :-|
Ludwig Wurmannstätter 25 Reputation points

2024-11-13T21:04:16.05+00:00

Hi @Pranay Reddy Madireddy ,

I think I found a possible explanation --> still doesn't solve the problem.

When I worked for Microsoft this Tenant had e.g., Office 365 IUR (Internal Use Rights) Licenses on it. When I left the company, these Licenses where removed and so where the Subscriptions with all the Content within the Subscription (all Resource groups, Workspaces. ...).

When I now click on Log Analytics in Entra, it seems there is an "old connection".
So the Question now is "how can I reset Entra in a way to start from scratch?"
Ludwig Wurmannstätter 25 Reputation points

2024-11-13T21:25:49.5833333+00:00

deleted
Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-14T18:27:40.82+00:00

Hi Ludwig Wurmannstätter
Once the workspace is deleted, you can create a new one by clicking the "Add" button in the toolbar at the top of the page. When creating a new Log Analytics workspace, ensure that you select the correct subscription and resource group. After the new workspace is created, you can begin using it to collect and analyze data.

thanks
Pranay
Ludwig Wurmannstätter 25 Reputation points

2024-11-15T07:51:44.62+00:00

but how can I delete a Workspace from a Subscription I'm no longer have or even see in my Tenant? Do you know of an PowerShell or GraphAPI command I can use?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-15T21:15:19.4333333+00:00

Hi Ludwig Wurmannstätter
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Ludwig Wurmannstätter 25 Reputation points

2024-11-15T22:24:23.04+00:00

Hi @Pranay Reddy Madireddy ,

I have no idea why my last post was deleted, except I had two images / results from PowerShell in it.
I'll try to answer in words and not with screenshots.
Your answer with the PS commands have been really helpful, both of them just gave me an error saying I can't set the context to something and later remove something that is not available in my Tenant.

At the end, if we are unable to see and deleted stuff Entra is trying to use, in this case a Subscription and a Workbook, we can do nothing to solve the issue.

Right?
Pranay Reddy Madireddy 6,340 Reputation points Moderator

2024-11-18T22:32:26.5233333+00:00

Hi Ludwig Wurmannstätter

Check that you're using the correct Azure subscription. Run this PowerShell command to see all subscriptions linked to your account:

Get-AzSubscription

Check that the Log Analytics workspace is in the subscription you're using.

If there’s no Log Analytics workspace in the subscription, you can create a new one using the Azure portal or PowerShell.

New-AzOperationalInsightsWorkspace -ResourceGroupName "<YourResourceGroup>" -Name "<YourWorkspaceName>" -Location "<YourLocation>" -Sku "PerGB2018"

If you prefer the command line, you can use Azure CLI to check for existing workspaces or create a new one.

az monitor log-analytics workspace list --resource-group <YourResourceGroup>

To create a new workspace:

az monitor log-analytics workspace create --resource-group <YourResourceGroup> --workspace-name <YourWorkspaceName> --location <YourLocation>

If a workspace was recently deleted, it might still be in a soft-delete state. Check if there are any soft-deleted workspaces in your subscription.

thanks
Pranay
Ludwig Wurmannstätter 25 Reputation points

2024-11-19T09:48:21.72+00:00

Hi Pranay,

thanks for the answer. I really carefully checked all my Subscriptions. But the one mentioned in the Entra Monitoring & health error message is not listed. And as I said, very likely that was one I deleted long time ago.

So I created a new Log Analytics workspace with PowerShell as you described. Btw. thanks for that very good and detailed description. Running the az command to list all workspaces and see it, looking at it in the Azure Portal I have it.

Lastly I checked my Roles on that Log Analytics workspace, inherited I'm a Service Administrator and directly given I'm a Log Analytics Contributor. I waited for some hours and then I checked again in Entra.

But back in the Entra Portal when I click on Log Analytics in Monitoring & health it still shows the error with the missing subscription ID. Entra does not pick up the newly created one.

From my point of view Entra simply picked up something really old and I'm unable to convince Entra to forget all that old stuff and pick up the new ones.

I will open a case with Microsoft.

I would like to say thank you to you, you've been such a valuable helping hand, but I think both of us are at the end of what we can do.

Answer 1

Pranay Reddy Madireddy 6,340 Moderator

Hi Ludwig Wurmannstätter
Open PowerShell and connect to your Azure account by using the Connect-AzAccount cmdlet.

Execute the following command to select the subscription that contains the workspace you wish to delete:

Set-AzContext -SubscriptionId <SubscriptionId>

Run the following command to delete the workspace:

Remove-AzOperationalInsightsWorkspace -ResourceGroupName <ResourceGroupName> -Name <WorkspaceName>

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".

Ludwig Wurmannstätter 25 Reputation points

2024-11-18T13:29:10.6366667+00:00

Hi @Pranay Reddy Madireddy ,

although the PowerShell commands did not solve the Problem they, at least, show the root cause. Entra Monitoring & health thinks there is a Log Analytics workspace, the commands show there is not even that Subscription, nor the Workspace.

Share via

Insufficient permissions when I click on Log Analytics or Workbooks

0 additional answers

Your answer