Unable to configure retention time for AzureDiagnostics table on LAW

Question

I'm creating templating that includes log analytics workspaces. I want to configure all my log analytics workspace before deploying other resources.

All other table configurations works(I know what is the issue with them) but setting table configuration for AzureDiagnostics table failes

template of mine

resource LongTermRetention 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = [for item in tablesConfig: {  
  name: item.name  
  parent: AscDataExportLaw  
  properties: {  
    plan: !contains(item, 'plan') ? 'Analytics' : item.plan  
    retentionInDays: !contains(item, 'retentionInDays') ? -1 : item.retentionInDays  
    totalRetentionInDays: !contains(item, 'totalRetentionInDays') ? totalRetentionInDays : item.totalRetentionInDays  
  }  
}]  

inputs:

{  
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",  
    "contentVersion": "1.0.0.0",  
    "parameters": {  
      "tablesConfig": {  
        "value": [  
          {  
            "name": "ADFTriggerRun"  
          },  
          {  
            "name": "AzureActivity"  
          },  
          {  
            "name": "AzureDiagnostics"  
          },  
          {  
            "name": "AzureMetrics"  
          }  
      ],  
      "retentionInDays": {  
        "value": 730 // 2 years  
      },  
      "totalRetentionInDays": {  
        "value": 1826 // 5 years  
      }  
    }  
  }  

Microsoft.OperationalInsights/workspaces/tables resource is created/updated for ADFTriggerRun, AzureActivity and AzureMetrics. Deployment for AzureDiagnostics fails with following error message:

{  
    "status": "Failed",  
    "error": {  
        "code": "ResourceNotFound",  
        "message": "The specified table: 'AzureDiagnostics' does not exist. Operation Id: '90043ab906b740e739e3af54f9b4f19d'"  
    }  
}  

Looks like AzureDiagnostics does not behave like other tables. For a good CI/CD/IaaC best practices configuration for AzureDiagnostics table should be deployable even then table has no data.

-------
Same behaviour is visible when configuring a new empty LAW tables:

AzureDiagnostics table cannot be configured because it does not exist....

---------
Full sample:

1. create rg: az group create --name law-config-rg --subscription $DevSubscriptionId
2. deploy template: az deployment group create -g law-config-rg --subscription $DevSubscriptionId -f logs.bicep
3. result:

law-config-logs-dev-law/ServiceMapComputer_CL, law-config-logs-dev-law/NetworkMonitoring and law-config-logs-dev-law/ServiceMapProcess_CL failures can be ignored in this discussion. The problem is AzureDiagnostics:

{  
    "status": "Failed",  
    "error": {  
        "code": "ResourceNotFound",  
        "message": "The specified table: 'AzureDiagnostics' does not exist. Operation Id: '229d68376b117a19f9214c2dfcab92c0'"  
    }  
}  

logs.bicep:

targetScope = 'resourceGroup'  
  
@description('Location for the resources.')  
param location string = resourceGroup().location  
param environmentName string = 'dev'  
param project string = 'law-config'  
param tags object = {}  
  
param azureDefenderEnabled bool = true  
  
param tablesConfig array = [  
  {  
    name: 'ADFActivityRun'  
  }  
  {  
    name: 'ADFPipelineRun'  
  }  
  {  
    name: 'ADFSandboxActivityRun'  
  }  
  {  
    name: 'ADFSandboxPipelineRun'  
  }  
  {  
    name: 'ADFTriggerRun'  
  }  
  {  
    name: 'AzureActivity'  
  }  
  {  
    name: 'AzureDiagnostics'  
  }  
  {  
    name: 'AzureMetrics'  
  }  
  {  
    name: 'DatabricksAccounts'  
  }  
  {  
    name: 'DatabricksClusters'  
  }  
  {  
    name: 'DatabricksDBFS'  
  }  
  {  
    name: 'DatabricksIAMRole'  
  }  
  {  
    name: 'DatabricksInstancePools'  
  }  
  {  
    name: 'DatabricksJobs'  
  }  
  {  
    name: 'DatabricksNotebook'  
  }  
  {  
    name: 'DatabricksSSH'  
  }  
  {  
    name: 'DatabricksSecrets'  
  }  
  {  
    name: 'DatabricksWorkspace'  
  }  
  {  
    name: 'Heartbeat'  
  }  
  {  
    name: 'InsightsMetrics'  
  }  
  {  
    name: 'NetworkMonitoring'  
  }  
  {  
    name: 'Operation'  
  }  
  {  
    name: 'PowerBIDatasetsWorkspace'  
  }  
  {  
    name: 'ProtectionStatus'  
  }  
  {  
    name: 'SecureScoreControls'  
  }  
  {  
    name: 'SecureScores'  
  }  
  {  
    name: 'SecurityAlert'  
  }  
  {  
    name: 'SecurityBaseline'  
  }  
  {  
    name: 'SecurityBaselineSummary'  
  }  
  {  
    name: 'SecurityDetection'  
  }  
  {  
    name: 'SecurityEvent'  
  }  
  {  
    name: 'SecurityNestedRecommendation'  
  }  
  {  
    name: 'SecurityRecommendation'  
  }  
  {  
    name: 'SecurityRegulatoryCompliance'  
  }  
  {  
    name: 'ServiceMapComputer_CL'  
  }  
  {  
    name: 'ServiceMapProcess_CL'  
  }  
  {  
    name: 'StorageBlobLogs'  
  }  
  {  
    name: 'StorageFileLogs'  
  }  
  {  
    name: 'StorageQueueLogs'  
  }  
  {  
    name: 'StorageTableLogs'  
  }  
  {  
    name: 'Update'  
  }  
  {  
    name: 'UpdateSummary'  
  }  
  {  
    name: 'Usage'  
  }  
  {  
    name: 'VMBoundPort'  
  }  
  {  
    name: 'VMComputer'  
  }  
  {  
    name: 'VMConnection'  
  }  
  {  
    name: 'VMProcess'  
  }  
  {  
    name: 'WindowsFirewall'  
  }  
]  
param retentionInDays int = 90  
param totalRetentionInDays int = 1095  
  
var LawName = '${project}-logs-${environmentName}-law'  
  
// setup LAW  
resource Law 'microsoft.operationalinsights/workspaces@2021-06-01' = {  
  name: LawName  
  location: location  
  tags: tags  
  properties: {  
    sku: {  
      name: 'PerGB2018'  
    }  
    retentionInDays: retentionInDays  
    features: {  
      enableLogAccessUsingOnlyResourcePermissions: true  
    }  
    workspaceCapping: {  
      dailyQuotaGb: -1  
    }  
    publicNetworkAccessForIngestion: 'Enabled'  
    publicNetworkAccessForQuery: 'Enabled'  
  }  
}  
  
// register solutions  
var solutions = concat([  
  'SecurityCenterFree'   
  'SQLVulnerabilityAssessment'  
], azureDefenderEnabled ? [  
  'Security'  
] : [] )  
resource AscDataExportLawSolution 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = [for solutionName in solutions: {  
  name: '${solutionName}(${Law.name})'  
  location: location  
  tags: tags  
  plan: {  
    name: '${solutionName}(${Law.name})'  
    promotionCode: ''  
    product: 'OMSGallery/${solutionName}'  
    publisher: 'Microsoft'  
  }  
  properties: {  
    workspaceResourceId: Law.id  
    containedResources: []  
  }  
}]  
  
resource LongTermRetention 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = [for item in tablesConfig: {  
  name: item.name  
  parent: Law  
  properties: {  
    plan: !contains(item, 'plan') ? 'Analytics' : item.plan  
    retentionInDays: !contains(item, 'retentionInDays') ? -1 : item.retentionInDays  
    totalRetentionInDays: !contains(item, 'totalRetentionInDays') ? totalRetentionInDays : item.totalRetentionInDays  
  }  
}]  

The result I want to see:
I want all configure archive retention times for all non-custom tables with IaaC automatically.

--------

Update: did minor update for logs.bicep:

Added deployment for solutions 'LogManagement' and 'NetworkMonitoring'. The error message for NetworkMonitoring was instantly fixed but AzureDiagnostics table config still does not work. Fixing that should not require hacks like log generation + waiting table to be created

Answer 1

Current workarounds:

Luck and yearly plan
* check "yearly" than nothing has been starting to use that table and re-deploy

Brute-force template
* run template multiple times

Add AzureDiagnostics table-based alerts for LAWs with this failure
* After the alert re-deploy template and disable alert

Create table with dummy template
* Requires adding more useless resources
* Requires deploying template multiple times
* Delays with table creation after log generation

None of those is not suitable for real production usage :/