Edit

Move a Log Analytics workspace to a different subscription or resource group

  • Article
  • 4 minutes to read

In this article, you'll learn the steps to move a Log Analytics workspace to another resource group or subscription in the same region. To learn more about how to move Azure resources through the Azure portal, PowerShell, the Azure CLI, or the REST API, see Move resources to a new resource group or subscription.

Important

You can't move a workspace to a different region by using this procedure. Follow the steps in the article Move a Log Analytics workspace to another region to move a workspace across regions.

Verify the Azure Active Directory tenant

The workspace source and destination subscriptions must exist within the same Azure Active Directory tenant. Use Azure PowerShell to verify that both subscriptions have the same tenant ID.

(Get-AzSubscription -SubscriptionName <your-source-subscription>).TenantId
(Get-AzSubscription -SubscriptionName <your-destination-subscription>).TenantId

Workspace move considerations

Consider these points before you move a Log Analytics workspace:

  • Managed solutions that are installed in the workspace will be moved in this operation.
  • The move operation requires that no services can be linked to the workspace. Solutions that rely on linked services must be removed prior to the move, including an Azure Automation account. These solutions must be removed before you can unlink your Automation account. Data collection for the solutions will stop and their tables will be removed from the UI, but data will remain in the workspace per the table retention period. When you add solutions after the move, ingestion is restored and tables become visible with data. Linked services include:
    • Update management
    • Change tracking
    • Start/Stop VMs during off-hours
    • Microsoft Defender for Cloud
  • Workspace keys (both primary and secondary) are regenerated with a workspace move operation. If you keep a copy of your workspace keys in Azure Key Vault, update them with the new keys generated after the workspace is moved.
  • Connected Log Analytics agents remain connected and keep sending data to the workspace after the move. Azure Monitor Agent will be disconnected via data collection rules during the move and should be reconfigured after the move.

Important

Microsoft Sentinel customers

  • Currently, after Microsoft Sentinel is deployed on a workspace, moving the workspace to another resource group or subscription isn't supported.
  • If you've already moved the workspace, disable all active rules under Analytics and reenable them after five minutes. This solution should be effective in most cases, although it's unsupported and undertaken at your own risk.
  • It could take Azure Resource Manager a few hours to complete. Solutions might be unresponsive during the operation.

Re-create alerts: All alerts must be re-created because the permissions are based on the workspace resource ID, which changes during a workspace move or resource name change. Alerts in workspaces created after June 1, 2019, or in workspaces that were upgraded from the legacy Log Analytics Alert API to the scheduledQueryRules API can be exported in templates and deployed after the move. You can check if the scheduledQueryRules API is used for alerts in your workspace. Alternatively, you can configure alerts manually in the target workspace.

Update resource paths: After a workspace move, any Azure or external resources that point to the workspace must be reviewed and updated to point to the new resource target path.

Examples:

Delete solutions in the Azure portal

Use the following procedure to remove solutions by using the Azure portal:

  1. Open the menu for the resource group where any solutions are installed.

  2. Select the solutions to remove.

  3. Select Delete Resources and then confirm the resources to be removed by selecting Delete.

    Screenshot that shows deleting solutions.

Delete by using PowerShell

To remove solutions by using PowerShell, use the Remove-AzResource cmdlet as shown in the following example:

Remove-AzResource -ResourceType 'Microsoft.OperationsManagement/solutions' -ResourceName "ChangeTracking(<workspace-name>)" -ResourceGroupName <resource-group-name>
Remove-AzResource -ResourceType 'Microsoft.OperationsManagement/solutions' -ResourceName "Updates(<workspace-name>)" -ResourceGroupName <resource-group-name>
Remove-AzResource -ResourceType 'Microsoft.OperationsManagement/solutions' -ResourceName "Start-Stop-VM(<workspace-name>)" -ResourceGroupName <resource-group-name>

Remove alert rules for the Start/Stop VMs solution

To remove the Start/Stop VMs solution, you also need to remove the alert rules created by the solution. Use the following procedure in the Azure portal to remove these rules:

  1. Open the Monitor menu and then select Alerts.

  2. Select Manage alert rules.

  3. Select the following three alert rules, and then select Delete:

    • AutoStop_VM_Child
    • ScheduledStartStop_Parent
    • SequencedStartStop_Parent

    Screenshot that shows deleting rules.

Use the following procedure to unlink the Automation account from the workspace by using the Azure portal:

  1. Open the Automation accounts menu and then select the account to remove.

  2. On the Related Resources section of the menu, select Linked workspace.

  3. Select Unlink workspace to unlink the workspace from your Automation account.

    Screenshot that shows unlinking a workspace.

Move your workspace

Move your workspace by using the Azure portal or PowerShell.

Azure portal

Use the following procedure to move your workspace by using the Azure portal:

  1. Open the Log Analytics workspaces menu and then select your workspace.

  2. On the Overview page, select change next to either Resource group or Subscription name.

  3. A new page opens with a list of resources related to the workspace. Select the resources to move to the same destination subscription and resource group as the workspace.

  4. Select a destination Subscription and Resource group. If you're moving the workspace to another resource group in the same subscription, you won't see the Subscription option.

  5. Select OK to move the workspace and selected resources.

    Screenshot that shows the Overview pane in the Log Analytics workspace with options to change the resource group and subscription name.

PowerShell

To move your workspace by using PowerShell, use the Move-AzResource cmdlet as shown in the following example:

Move-AzResource -ResourceId "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup01/providers/Microsoft.OperationalInsights/workspaces/MyWorkspace" -DestinationSubscriptionId "00000000-0000-0000-0000-000000000000" -DestinationResourceGroupName "MyResourceGroup02"

Important

After the move operation, removed solutions and the Automation account link should be reconfigured to bring the workspace back to its previous state.

Next steps

For a list of which resources support the move operation, see Move operation support for resources.