Hello @Grafton, Darren ,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
I understand that you would like to know if the diagnostic settings to send logs to a log analytics workspace happens privately in Azure.
Logs and metrics uploaded to a workspace via Diagnostic Settings go over a secure private Microsoft channel.
Refer : https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-design#exceptions
However, if you would like to connect privately to Azure Monitor ensuring that your monitoring data is only accessed through authorized private networks, then you could setup Azure Private Link to connect networks to Azure Monitor.
Refer : https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-design
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-configure
Kindly let us know if the above helps or you need further assistance on this issue.
----------------------------------------------------------------------------------------------------------------
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.