Store NSG flow logs of multiple subscription in one storage account

Question

Store NSG flow logs of multiple subscription in one storage account

Anish Kumar Das 0

I am trying to store NSG flow logs of multiple subscription in a single storage account to enable centralised storage of flow logs instead of using multiple storage account. As already we have a limitation to use storage account in the same region to store the flow logs. So the number of storage account is already high.

Sumarigo-MSFT 47,471 Reputation points Microsoft Employee Moderator

2023-08-03T07:23:21.6966667+00:00

@Anish Kumar Das Just checking in to see if the below answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

2 answers

Your answer

Sumarigo-MSFT 47,471 Reputation points Microsoft Employee Moderator

2023-08-03T07:23:21.6966667+00:00

@Anish Kumar Das Just checking in to see if the below answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

SUNOJ KUMAR YELURU 15,491 MVP Volunteer Moderator

Hello @Anish Kumar Das

NSG Flow Logging Data Across Subscriptions

Previously NSG Flow Logs could only be sent to storage accounts located in the same region and subscription as the NSG. We heard from customers running centralized monitoring teams managing multiple subscriptions, that consolidation of logs into as few storage accounts as possible was a one of the most desired features requested for the future roadmap of Network Watcher, so we made it happen!

Now, you can configure NSG Flow Logs to be sent to a storage account located in a different subscription, provided you have the appropriate privileges, and that the storage account is located in the same region as the NSG. The NSG and the destination storage account must also share the same Azure Active Directory Tenant.

If this answers your query, do click `Accept Answer` and **Up-Vote** for the same. And, if you have any further query do let us know.

Anish Kumar Das 0 Reputation points

2023-08-03T07:46:56.5666667+00:00

I have gone through the link you have shared, but do not see any specifics to the changes that need to be made in the current environment as I already have owner access to both the subscriptions where the NSG and the storage account is present and both are in the same region an under same Azure AD tennant and Management Group as well. But when I try it I am not able to see the storage account in different subscruption while enabling the flow logs.
Sumarigo-MSFT 47,471 Reputation points Microsoft Employee Moderator

2023-08-09T02:55:49+00:00

@Anish Kumar Das I understand that you want to store NSG flow logs of multiple subscriptions in a single storage account to enable centralized storage of flow logs instead of using multiple storage accounts. However, as you mentioned, there is a limitation to use storage accounts in the same region to store the flow logs . Therefore, the number of storage accounts is already high(what exactly that means)

Are you're facing a specific issue when trying to enable NSG flow logs from multiple subscriptions to a single storage account, even though they are in the same region and under the same Azure AD tenant and Management Group?

One possible solution to this problem is to use Azure Event Hubs to centralize the flow logs. You can configure the NSG flow logs to send data to an Event Hub, which can then be used to store and analyze the data. This way, you can store the flow logs from multiple subscriptions in a single Event Hub, which can be more cost-effective than using multiple storage accounts.

To configure NSG flow logs to send data to an Event Hub, you can follow the steps outlined in this article: Send NSG flow logs to an event hub.
Jake Linebaugh 20 Reputation points

2024-01-24T21:04:28.9866667+00:00
Microsoft is just full of it. According to this https://azure.microsoft.com/es-es/blog/new-azure-network-watcher-integrations-and-network-security-group-flow-logging-updates/ it should work. Same regions, same Entra Tenant, storage account meets all requirements. I have permissions to everything... yet still it fails

"status": "Failed", "error": { "code": "GatewayAuthenticationFailed", "message": "Gateway authentication failed for 'Microsoft.Network'. Diagnostic information: timestamp '20240124T210113Z', tracking id 'guid you dont need do know', request correlation id 'another guid'." }

Answer 2

Jake Linebaugh 20

why....why cant they just make something work that they promised would work. Just like VS Code and https://azure.microsoft.com/es-es/blog/new-azure-network-watcher-integrations-and-network-security-group-flow-logging-updates/

Share via

Store NSG flow logs of multiple subscription in one storage account

2 answers

Your answer