Which resources require workspace key to connect to Log Analytics workspaces ?

Question

Which resources require workspace key to connect to Log Analytics workspaces ?

Julian D'Cruze 25

Hello, I was just wondering which resources require the use of a workspace key to connect to a log analytics workspace? currently I know that VMs, containers and DevOps can use such a connection. However I was wondering if anyone knew of a concrete list of all resources that would require the workspace key to make that connection.

Accepted answer

0 additional answers

Your answer

Answer 1

AnuragSingh-MSFT 21,551 Moderator

@Julian D'Cruze , By "workspace key", do you mean the "Primary/Secondary Key" as available in Agents section of Log Analytics workspace's resource menu as shown below?

User's image

The keys available here serve as authentication for any resource sending information to LA workspace. It could be from VM (by installing agent) OR through API as mentioned here - Send log data to Log Analytics with the HTTP Data Collector API.

Generally, all the resources in Azure send their Monitoring logs and metrics to this workspace. However, because they are part of Azure this authentication part is taken care of by Azure platform, hence you do not have to explicitly use these keys.

For any resource fully owned by you (you application, VMs etc.) or resources which might not be part of Azure platform but would utilize API to send data, they need these keys to be able to authenticate as mentioned here - Send log data to Azure Monitor by using the HTTP Data Collector API (preview). There is no concrete list available now, because this will keep varying depending on the use case.

Can you please share the reason for your search of such a list which might use this key?

If your question was about something else, please share additional context/screenshots (as required) to help us understand this issue better.

Hope this helps. Please let me know if you have any questions.

Julian D'Cruze 25 Reputation points

2023-05-02T18:59:25.03+00:00

@AnuragSingh-MSFT Yes, I mean the "Primary/Secondary Key" as available in Agents section of Log Analytics workspace's resource menu as shown in your picture.

Yes no problem. The reason I was asking is because my organization was planning to perform key rotation (rotating all resources currently using the primary to the secondary key then regenerating the primary key and then rotating all resources back to the primary key and regenerating the secondary in order to secure our Logs) so we wanted to see which resources were currently connected to our Log Analytics Workspace via a workspace key.

Please let me know if there a is better way to perform key rotation since we know it is best practice
AnuragSingh-MSFT 21,551 Reputation points Moderator

2023-05-03T06:14:56.7566667+00:00
Julian D'Cruze, thank you for the detailed information.

The best way to get all the resources which are sending data to this particular Log Analytics workspace would be the Logs in Log analytics workspace. All the tables in Log Analytics workspace have a standard column - _ResourceId. This column contains the id of resource which is sending the data to the workspace. For mor details, see this link.

Therefore, you can query the workspace logs using something like below which will give you the list of all resources sending data to this workspace:

union * | distinct _ResourceId

union * --> combines the logs from all tables and "distinct _ResourceId" gives you only unique ids available for resources.

Most of these resources might not even require any update related to key rotation. Only VM, custom application will require changes.

Hope this helps.

If the response here helped, please click Accept answer so that it can help others in the community looking for help on similar topics.
Julian D'Cruze 25 Reputation points

2023-05-03T11:31:28.9333333+00:00

@AnuragSingh-MSFT Thank you for the information. Just confirming that we are unable to query for resources that are logging to the workspace using a workspace key (primary or secondary) right?

Also for key rotation right now the only resources I feel might need key rotation as of right now are VMs, Containers, Custom applications, and DevOps.

In terms of the key rotation, I was wondering if what I mentioned earlier was the best way to do it, or is there a better way to do it? and is there any documentation which should be used to follow for it?
AnuragSingh-MSFT 21,551 Reputation points Moderator

2023-05-04T04:55:07.2866667+00:00
Julian D'Cruze, to answer your question - "Just confirming that we are unable to query for resources that are logging to the workspace using a workspace key (primary or secondary) right?" - Not really.

A number of resources returned using this query might be using other mechanism to send data to LA workspace, for example

Diagnostic settings - This is fully Azure managed and by only selecting the target LA workspace, the data starts getting sent to it. For such resources using this setting, the key rotation won't have any impact.

Application Insights (or any other type of insights) - this is also Azure managed and there will no impact related to key rotation.

Thus, the query that I shared earlier would report ALL the resources which are sending data to LA Workspace, but NOT ALL will be using the key.

Regarding your second question, yes - the VMs are the main resources which will be impacted - However, only those VMs will be impacted which are using legacy Log Analytics Agent. If these VMs are being monitored through the latest Azure Monitor Agent - they do not use the keys for sending data to LA Workspace.

Similarly, with custom application - only those applications would be using keys which are using the HTTP Data Collector API. However, if these applications are monitored using ApplicationInsights, they will not be impacted with key rotation (even though AppInsights uses LA Workspace to store telemetry).

For containers, depending on what kind of monitoring is being used - it may or may not be using the keys. If you are using Container group and instance logging with Azure Monitor logs, they key is used. However, for container insights, it is platform managed.

For your last question, yes that is the recommended way of doing the key rotation.

Hope this helps.
Julian D'Cruze 25 Reputation points

2023-05-04T17:28:23.5733333+00:00

@AnuragSingh-MSFT Thank you for all the information.

Regarding the Key rotation of Log analytics Workspace is there any documentation you suggest to follow to help with it ?

Also wondering when attaching Vms and containers to the new key is there any documentation on that as well ?
AnuragSingh-MSFT 21,551 Reputation points Moderator

2023-05-08T08:46:42.9766667+00:00

Julian D'Cruze, please find answers to your queries below:

Regarding the Key rotation of Log analytics Workspace is there any documentation you suggest to follow to help with it ? - I tried looking for such doc, but I dont think it is available. The basic process for any key rotation is as you have already mentioned in the question.

Also wondering when attaching Vms and containers to the new key is there any documentation on that as well ? - For new VMs, the connection via key (through log Analytics agent) is not recommended anymore. Azure Monitor Agent is the latest agent for monitoring VMs which does not require the key. Regarding containers, if you are using AKS or any of the supported tools available here, you can use container insights. This also does not require the keys to connect to LA workspace. For Azure Container instance, the details are available here - Container group and instance logging with Azure Monitor logs.

Hope this helps. Please feel free to post a new question for any additional queries, so that we can scope the discussion on this thread to a single topic.
MOLLOY, STEVEN D 0 Reputation points

2025-07-03T22:32:58.32+00:00

Thank You @AnuragSingh-MSFT for the valuable answers given to this question. My Org is also tightening security for Keys (and Secrets stored in a Key Vault) and I couldnt locate any resources in my subscription referencing the key stored in my KV. This answer helped me to understand the PSK usage to determine that I dont need to store this key in a KV at all. So therefore, I can delete it from the KV, and not worry about it triggering a vulnerability rule in our monitoring system. Thank you very much!

Share via

Which resources require workspace key to connect to Log Analytics workspaces ?

0 additional answers

Your answer