Create a virtual network flow log by using an Azure Resource Manager template

In this article, you use an Azure Resource Manager (ARM) template to create a virtual network flow log for an existing virtual network. The template also creates an Azure storage account for the flow log data. For more information, see Virtual network flow logs overview and What are ARM templates?

An Azure Resource Manager template is a JavaScript Object Notation (JSON) file that defines the infrastructure and configuration for your project. The template uses declarative syntax. You describe your intended deployment without writing the sequence of programming commands to create the deployment.

If your environment meets the prerequisites and you're familiar with using ARM templates, select Deploy to Azure. In the Azure portal, select the resource group that contains the Network Watcher instance, enter the resource ID of your virtual network, and set Location to the virtual network's region.

An Azure account with an active subscription. If you don't have one, create a free account before you begin.
An existing virtual network. The virtual network must be in the same region as the Network Watcher instance. If you need to create one, see Create a virtual network using PowerShell.
Azure PowerShell installed locally. For more information, see Install Azure PowerShell. Sign in by using the Connect-AzAccount cmdlet.

Review the template

This article uses the Create virtual network flow logs template from Azure Quickstart Templates. For more information, see Enable Virtual Network Flow Logs.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.46.1.21595",
      "templateHash": "17695204249265756820"
    }
  },
  "parameters": {
    "networkWatcherName": {
      "type": "string",
      "defaultValue": "[format('NetworkWatcher_{0}', parameters('location'))]",
      "metadata": {
        "description": "Name of the Network Watcher attached to your subscription. Format: NetworkWatcher_<region_name>"
      }
    },
    "flowLogName": {
      "type": "string",
      "defaultValue": "VNetFlowLog1",
      "metadata": {
        "description": "Name of your flow log resource"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Region where your resources are located"
      }
    },
    "existingVNet": {
      "type": "string",
      "metadata": {
        "description": "Resource ID of the target virtual network"
      }
    },
    "retentionDays": {
      "type": "int",
      "defaultValue": 0,
      "minValue": 0,
      "maxValue": 365,
      "metadata": {
        "description": "Retention period in days. Default is zero which stands for permanent retention. Can be any Integer from 0 to 365"
      }
    },
    "flowLogsVersion": {
      "type": "int",
      "defaultValue": 2,
      "allowedValues": [
        1,
        2
      ],
      "metadata": {
        "description": "FlowLogs Version. Correct values are 1 or 2 (default)"
      }
    },
    "storageAccountType": {
      "type": "string",
      "defaultValue": "Standard_LRS",
      "allowedValues": [
        "Standard_LRS",
        "Standard_GRS",
        "Standard_ZRS"
      ],
      "metadata": {
        "description": "Storage Account type"
      }
    }
  },
  "variables": {
    "storageAccountName": "[format('flowlogs{0}', uniqueString(resourceGroup().id))]"
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2021-09-01",
      "name": "[variables('storageAccountName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "[parameters('storageAccountType')]"
      },
      "kind": "StorageV2",
      "properties": {}
    },
    {
      "type": "Microsoft.Network/networkWatchers",
      "apiVersion": "2024-10-01",
      "name": "[parameters('networkWatcherName')]",
      "location": "[parameters('location')]",
      "properties": {}
    },
    {
      "type": "Microsoft.Network/networkWatchers/flowLogs",
      "apiVersion": "2024-10-01",
      "name": "[format('{0}/{1}', parameters('networkWatcherName'), parameters('flowLogName'))]",
      "location": "[parameters('location')]",
      "properties": {
        "targetResourceId": "[parameters('existingVNet')]",
        "storageId": "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]",
        "enabled": true,
        "retentionPolicy": {
          "days": "[parameters('retentionDays')]",
          "enabled": true
        },
        "format": {
          "type": "JSON",
          "version": "[parameters('flowLogsVersion')]"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkWatchers', parameters('networkWatcherName'))]",
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
      ]
    }
  ],
  "outputs": {
    "flowLogName": {
      "type": "string",
      "value": "[parameters('flowLogName')]"
    },
    "storageAccountName": {
      "type": "string",
      "value": "[variables('storageAccountName')]"
    }
  }
}

The template defines the following resources:

The highlighted code defines a virtual network flow log whose targetResourceId is the resource ID of an existing virtual network.

Deploy the template

You must deploy the flow log to the resource group that contains the Network Watcher instance for the virtual network's region.

PowerShell
Azure CLI

Save the ARM template as azuredeploy.json on your local computer.

Set the virtual network and Network Watcher variables. Replace the placeholder values with your values.

$vnet = Get-AzVirtualNetwork -Name '<virtual-network-name>' -ResourceGroupName '<virtual-network-resource-group>'
$networkWatcher = Get-AzNetworkWatcher -Location $vnet.Location

Deploy the template.

$deployment = New-AzResourceGroupDeployment `
    -Name 'createVNetFlowLog' `
    -ResourceGroupName $networkWatcher.ResourceGroupName `
    -TemplateFile ./azuredeploy.json `
    -location $vnet.Location `
    -networkWatcherName $networkWatcher.Name `
    -existingVNet $vnet.Id

Save the ARM template as azuredeploy.json on your local computer.

Set the virtual network and Network Watcher variables. Replace the placeholder values with your values.

vnetId=$(az network vnet show --name '<virtual-network-name>' --resource-group '<virtual-network-resource-group>' --query id --output tsv)
location=$(az network vnet show --ids "$vnetId" --query location --output tsv)
networkWatcherResourceGroup=$(az network watcher list --query "[?location=='$location'].resourceGroup | [0]" --output tsv)
networkWatcherName=$(az network watcher list --query "[?location=='$location'].name | [0]" --output tsv)

Deploy the template.

az deployment group create \
    --name 'createVNetFlowLog' \
    --resource-group "$networkWatcherResourceGroup" \
    --template-file azuredeploy.json \
    --parameters location="$location" networkWatcherName="$networkWatcherName" existingVNet="$vnetId"

When the deployment finishes, the output shows that the provisioning state is Succeeded.

Validate the deployment

PowerShell
Azure CLI

Use Get-AzNetworkWatcherFlowLog to verify the flow log:

Get-AzNetworkWatcherFlowLog `
    -NetworkWatcherName $networkWatcher.Name `
    -ResourceGroupName $networkWatcher.ResourceGroupName `
    -Name $deployment.Outputs.flowLogName.Value

Use az network watcher flow-log show to verify the flow log:

az network watcher flow-log show \
    --name 'VNetFlowLog1' \
    --resource-group "$networkWatcherResourceGroup" \
    --location "$location"

You can also go to Network Watcher > Flow logs in the Azure portal to confirm the flow log settings.

If you encounter deployment issues, see Troubleshoot common Azure deployment errors.

Clean up resources

When you no longer need the flow log and storage account, delete them.

PowerShell
Azure CLI

Remove-AzNetworkWatcherFlowLog `
    -Name $deployment.Outputs.flowLogName.Value `
    -Location $vnet.Location

Remove-AzStorageAccount `
    -ResourceGroupName $networkWatcher.ResourceGroupName `
    -Name $deployment.Outputs.storageAccountName.Value

storageAccountName=$(az deployment group show --name 'createVNetFlowLog' --resource-group "$networkWatcherResourceGroup" --query properties.outputs.storageAccountName.value --output tsv)

az network watcher flow-log delete \
    --name 'VNetFlowLog1' \
    --location "$location"

az storage account delete \
    --name "$storageAccountName" \
    --resource-group "$networkWatcherResourceGroup" \
    --yes

Feedback

Was this page helpful?

Last updated on 2026-08-05