How to access Log Analytic Workspace from browser if public query is blocked

Andy Lim 0

Hi team,

I have a use case here, where Log Analytic Workspace public log ingestion and public query are blocked. The Log Analytic Workspace is integrated with AKS along with Azure Monitor PrivateLink Scope. There's no issue so far on the log ingestion from AKS, since I tested it by enabling public query for Log Analytic Workspace. However, in my organization, we would like to keep both public log ingestion and query disabled to adhere the Azure policy https://www.azadvertizer.net/azpolicyadvertizer/dddfa1af-dcd6-42f4-b5b0-e1db01e0b405.html

May I know how can we allow our developers to access Log Analytic Workspace from browser? If we cannot access it via browser, do we have to create a VM to access the logs from Log Analytic Workspace? Otherwise, what are the alternatives? Thank you.

Pranay Reddy Madireddy 365 Reputation points Microsoft Vendor

2024-10-02T02:22:15.18+00:00

Hii Andy Lim

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Azure Bastion allows you to connect to your Azure Virtual Machines (VMs) securely from the Azure portal without using the public internet. You create a VM in the same network as your Log Analytics Workspace and use Azure Bastion to access that VM through your browser. This lets developers run commands to check logs securely, keeping everything safe and private.

Make sure developers have the right permissions to use Azure Monitor Private Link. Other Azure Monitor resources like the Log Analytics workspaces configured in your data collection rules that you want to send data to must be part of this same AMPLS resource.

For your data collection endpoints, ensure the Accept access from public networks not connected through a Private Link Scope option is set to No on the Network Isolation tab of your endpoint resource in the Azure portal. This setting ensures that public internet access is disabled and network communication only happens via private links.

Developers can use the Azure Monitor REST API to access logs. By using tools like their own apps on a secure VM, they can run queries on Log Analytics safely, without needing public internet access.

You can also create a custom dashboard that uses the Azure Monitor API to pull data from Log Analytics. This dashboard can be hosted internally or in Azure, so developers can access logs easily without using a browser.

For reference, please review this documentation:- https://learn.microsoft.com/en-us/azure/bastion/connect-vm-native-client-windows

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-private-link

https://www.geeksforgeeks.org/creating-dashboards-with-azure-monitor-data/

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-private-link

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Pranay Reddy Madireddy 365 Reputation points Microsoft Vendor

2024-10-04T14:58:45.4+00:00

Hii Andy Lim
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Pranay Reddy Madireddy 365 Reputation points Microsoft Vendor

2024-10-07T15:43:09.8933333+00:00

Andy Lim- If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!

Share via

How to access Log Analytic Workspace from browser if public query is blocked

Your answer