Log Analytics Workspace: "Unknown" under Operational Issues

Question

Log Analytics Workspace: "Unknown" under Operational Issues

Jordi Parareda 0

There is no way for me to access the logs of any resource. I have created a Log Analytics Workspace. It shows "Unknown" under Operational Issues. Could you check what’s happening or let me know what else I need to do?

I believe I have the necessary permissions for everything and don't need to assign myself any additional role.

Vahid Ghafarpour 23,285 Reputation points Moderator

2025-04-21T02:32:52.98+00:00

Thanks for posting your question in the Microsoft Q&A forum.

double-check that you have Microsoft.OperationalInsights/workspaces/query//read* permissions. The Log Analytics Reader role should grant this access.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/monitor-workspace

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful **

Jordi Parareda 0

Thank you, Vahid, for your response. I have the Log Analytics Reader role assigned to the entire resource group, but the issue remains the same. "Unknown" under Operational Issues and an authorization error when accessing the logs.

I post the error below
{

"shellProps": {

	"sessionId": "<<session-id>>",

	"extName": "Microsoft_OperationsManagementSuite_Workspace",

	"contentName": "Logs.ReactView",

	"resourceId": "/subscriptions/<<my-tenant>>/resourceGroups/<<my-group>>/providers/Microsoft.OperationalInsights/workspaces/<<my-workspace>>",

	"code": 403

},

"error": {

	"message": "You do not have authorization to access this resource. /subscriptions/<<my-tenant>>/resourcegroups/<<my-group>>/providers/microsoft.operationalinsights/workspaces/<<my-workspace>>",

	"code": 403

}

}

Thank for your help.

Vinod Pittala 2,315 Reputation points Microsoft External Staff Moderator

2025-04-21T08:44:11.7466667+00:00

Hello Jordi Parareda,

You need */read /Log Analytics Reader permissions to the Log Analytics workspace, which can be provided by the Log Analytics Reader built-in role. If you are unsure, you can verify your role assignments.

Additionally, make sure that your Log Analytics Workspace is correctly configured to collect logs from the resources you want to monitor. This includes ensuring that the resources are properly linked to the workspace.

Please review it let us know if you encounter any issues while assigning the permission.

Thanks
Jordi Parareda 0 Reputation points

2025-04-21T09:26:44.63+00:00

Thank you, Vinod, for your response. I am pretty sure I have Log Analytics Reader role assigned, even Log Analytics Contributor and also I am the subscription owner role.

However, I am not sure what you mean by "resources are properly linked to the workspace." Could you please provide more information about that?

Thank you for your help.
David Broggy 6,281 Reputation points MVP Moderator

2025-04-21T13:49:31.4333333+00:00
Hi @Jordi Parareda

I would suggest taking a step back and validating a few things:

create a new resource group

2 add a new log analytics workspace to the new resource group

If you get this far then you have no permission issues, if you get errors, you have to go back and check your roles.

3 add log sources to your log analytics workspace. eg. Activity Log > Diagnostics > configure diagnostics logs to point to log analytics.

4 go back to the log analytics workspace resource > logs and search your logs.

Hope that helps.
Jordi Parareda 0 Reputation points

2025-04-21T14:31:20.97+00:00

Hi David,

thanks for your response. I am able to create a log analytics workspace in a new resource group, but I got this error when trying to create a Diagnostic setting:

Failed to update diagnostics for 'LogsWorkspace'.{"code":"InvalidAuthenticationToken","message":"Please register the subscription '<<my-tenant>>' with Microsoft.Insights."}.

However, Microsoft.Insights is already registered.

I think something else is broken because I am unable to see Tables in the Workspace. When trying to access them, I receive the following error:

{"error":{"message":"The provided credentials have insufficient access to perform the requested operation","code":"InsufficientAccessError","correlationId":"8eca92f7-5e14-4e73-838a-d7eee1561776"}}

Any alternative suggestions?
Pranay Reddy Madireddy 4,590 Reputation points Microsoft External Staff Moderator

2025-04-22T00:32:36.22+00:00

Hi Jordi Parareda

For the error related to updating diagnostics, verify that you have the necessary permissions to modify diagnostic settings for the resource you are trying to configure. You may need to contact your Azure subscription administrator to verify your access rights.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/azure-resource-queries#no-access-to-resource

https://learn.microsoft.com/en-us/power-bi/transform-model/log-analytics/desktop-log-analytics-configure?tabs=refresh#error-conditions-and-resolutions
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/monitor-workspace#ingestion

let us know if any help, we will always help as you needed.!

If the comment is helpful, please click "Upvote it".
Jordi Parareda 0 Reputation points

2025-04-22T16:01:10.65+00:00

Hi Pranay, thanks for your response and thank you for all this information as well. I’ll keep it for future reference.

As I already mentioned in a previous comment, something else was broken underneath because it wasn’t a permissions issue since I’m the owner.

It looks like someone has changed something in the backend, because fortunately, it’s now resolved. The status has changed to OK, and I can finally access the Logs section of any resource.

Thanks to everyone for your comments, advice, and help.
Jordi Parareda 0 Reputation points

2025-04-22T16:02:52.04+00:00

It was resolved without taking any action. Something was broken underneath, and the Azure team fixed it perfectly. Thanks to everyone.
Pranay Reddy Madireddy 4,590 Reputation points Microsoft External Staff Moderator

2025-04-22T20:22:06.86+00:00

Hi Jordi Parareda
Thanks, for the update.

Your answer

Vahid Ghafarpour 23,285 Reputation points Moderator

2025-04-21T02:32:52.98+00:00

Thanks for posting your question in the Microsoft Q&A forum.

double-check that you have Microsoft.OperationalInsights/workspaces/query//read* permissions. The Log Analytics Reader role should grant this access.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/monitor-workspace

** Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful **
Jordi Parareda 0 Reputation points

2025-04-21T06:21:35.6133333+00:00

Thank you, Vahid, for your response. I have the Log Analytics Reader role assigned to the entire resource group, but the issue remains the same. "Unknown" under Operational Issues and an authorization error when accessing the logs.

I post the error below
{

"shellProps": { "sessionId": "<<session-id>>", "extName": "Microsoft_OperationsManagementSuite_Workspace", "contentName": "Logs.ReactView", "resourceId": "/subscriptions/<<my-tenant>>/resourceGroups/<<my-group>>/providers/Microsoft.OperationalInsights/workspaces/<<my-workspace>>", "code": 403 }, "error": { "message": "You do not have authorization to access this resource. /subscriptions/<<my-tenant>>/resourcegroups/<<my-group>>/providers/microsoft.operationalinsights/workspaces/<<my-workspace>>", "code": 403 }

}

Thank for your help.
Vinod Pittala 2,315 Reputation points Microsoft External Staff Moderator

2025-04-21T08:44:11.7466667+00:00

Hello Jordi Parareda,

You need */read /Log Analytics Reader permissions to the Log Analytics workspace, which can be provided by the Log Analytics Reader built-in role. If you are unsure, you can verify your role assignments.

Additionally, make sure that your Log Analytics Workspace is correctly configured to collect logs from the resources you want to monitor. This includes ensuring that the resources are properly linked to the workspace.

Please review it let us know if you encounter any issues while assigning the permission.

Thanks
Jordi Parareda 0 Reputation points

2025-04-21T09:26:44.63+00:00

Thank you, Vinod, for your response. I am pretty sure I have Log Analytics Reader role assigned, even Log Analytics Contributor and also I am the subscription owner role.

However, I am not sure what you mean by "resources are properly linked to the workspace." Could you please provide more information about that?

Thank you for your help.
David Broggy 6,281 Reputation points MVP Moderator

2025-04-21T13:49:31.4333333+00:00

Hi @Jordi Parareda

I would suggest taking a step back and validating a few things:

create a new resource group

2 add a new log analytics workspace to the new resource group

If you get this far then you have no permission issues, if you get errors, you have to go back and check your roles.

3 add log sources to your log analytics workspace. eg. Activity Log > Diagnostics > configure diagnostics logs to point to log analytics.

4 go back to the log analytics workspace resource > logs and search your logs.

Hope that helps.
Jordi Parareda 0 Reputation points

2025-04-21T14:31:20.97+00:00

Hi David,

thanks for your response. I am able to create a log analytics workspace in a new resource group, but I got this error when trying to create a Diagnostic setting:

Failed to update diagnostics for 'LogsWorkspace'.{"code":"InvalidAuthenticationToken","message":"Please register the subscription '<<my-tenant>>' with Microsoft.Insights."}.

However, Microsoft.Insights is already registered.

I think something else is broken because I am unable to see Tables in the Workspace. When trying to access them, I receive the following error:

{"error":{"message":"The provided credentials have insufficient access to perform the requested operation","code":"InsufficientAccessError","correlationId":"8eca92f7-5e14-4e73-838a-d7eee1561776"}}

Any alternative suggestions?
Pranay Reddy Madireddy 4,590 Reputation points Microsoft External Staff Moderator

2025-04-22T00:32:36.22+00:00

Hi Jordi Parareda

For the error related to updating diagnostics, verify that you have the necessary permissions to modify diagnostic settings for the resource you are trying to configure. You may need to contact your Azure subscription administrator to verify your access rights.

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/api/azure-resource-queries#no-access-to-resource

https://learn.microsoft.com/en-us/power-bi/transform-model/log-analytics/desktop-log-analytics-configure?tabs=refresh#error-conditions-and-resolutions
https://learn.microsoft.com/en-us/azure/azure-monitor/logs/monitor-workspace#ingestion

let us know if any help, we will always help as you needed.!

If the comment is helpful, please click "Upvote it".
Jordi Parareda 0 Reputation points

2025-04-22T16:01:10.65+00:00

Hi Pranay, thanks for your response and thank you for all this information as well. I’ll keep it for future reference.

As I already mentioned in a previous comment, something else was broken underneath because it wasn’t a permissions issue since I’m the owner.

It looks like someone has changed something in the backend, because fortunately, it’s now resolved. The status has changed to OK, and I can finally access the Logs section of any resource.

Thanks to everyone for your comments, advice, and help.
Jordi Parareda 0 Reputation points

2025-04-22T16:02:52.04+00:00

It was resolved without taking any action. Something was broken underneath, and the Azure team fixed it perfectly. Thanks to everyone.
Pranay Reddy Madireddy 4,590 Reputation points Microsoft External Staff Moderator

2025-04-22T20:22:06.86+00:00

Hi Jordi Parareda
Thanks, for the update.

Share via

Log Analytics Workspace: "Unknown" under Operational Issues

Your answer