Microsoft.OperationalInsights workspaces/dataExports

• Latest
• 2025-07-01
• 2025-02-01
• 2023-09-01
• 2020-08-01
• 2020-03-01-preview
• 2019-08-01-preview

Bicep resource definition

The workspaces/dataExports resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.OperationalInsights/workspaces/dataExports resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.OperationalInsights/workspaces/dataExports@2025-07-01' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    createdDate: 'string'
    dataExportId: 'string'
    destination: {
      metaData: {
        eventHubName: 'string'
      }
      resourceId: 'string'
    }
    enable: bool
    lastModifiedDate: 'string'
    tableNames: [
      'string'
    ]
  }
}

Property Values

Microsoft.OperationalInsights/workspaces/dataExports

Name	Description	Value
name	The resource name	string (required)
parent	In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource. For more information, see Child resource outside parent resource.	Symbolic name for resource of type: workspaces
properties	data export properties.	DataExportProperties

DataExportProperties

Name	Description	Value
createdDate	The latest data export rule modification time.	string
dataExportId	The data export rule ID.	string
destination	destination properties.	Destination
enable	Active when enabled.	bool
lastModifiedDate	Date and time when the export was last modified.	string
tableNames	An array of tables to export, for example: [“Heartbeat, SecurityEvent”].	string[] (required)

Destination

Name	Description	Value
metaData	destination meta data.	DestinationMetaData
resourceId	The destination resource ID. This can be copied from the Properties entry of the destination resource in Azure.	string (required)

DestinationMetaData

Name	Description	Value
eventHubName	Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account.	string

Usage Examples

Bicep Samples

A basic example of deploying log analytics Data Export Rule.

param location string = 'westeurope'
param resourceName string = 'acctest0001'

resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
  name: resourceName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
    allowBlobPublicAccess: true
    allowCrossTenantReplication: true
    allowSharedKeyAccess: true
    defaultToOAuthAuthentication: false
    encryption: {
      keySource: 'Microsoft.Storage'
      services: {
        queue: {
          keyType: 'Service'
        }
        table: {
          keyType: 'Service'
        }
      }
    }
    isHnsEnabled: false
    isNfsV3Enabled: false
    isSftpEnabled: false
    minimumTlsVersion: 'TLS1_2'
    networkAcls: {
      defaultAction: 'Allow'
    }
    publicNetworkAccess: 'Enabled'
    supportsHttpsTrafficOnly: true
  }
}

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource dataExport 'Microsoft.OperationalInsights/workspaces/dataExports@2020-08-01' = {
  name: resourceName
  parent: workspace
  properties: {
    destination: {
      resourceId: storageAccount.id
    }
    enable: false
    tableNames: [
      'Heartbeat'
    ]
  }
}

ARM template resource definition

The workspaces/dataExports resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.OperationalInsights/workspaces/dataExports resource, add the following JSON to your template.

{
  "type": "Microsoft.OperationalInsights/workspaces/dataExports",
  "apiVersion": "2025-07-01",
  "name": "string",
  "properties": {
    "createdDate": "string",
    "dataExportId": "string",
    "destination": {
      "metaData": {
        "eventHubName": "string"
      },
      "resourceId": "string"
    },
    "enable": "bool",
    "lastModifiedDate": "string",
    "tableNames": [ "string" ]
  }
}

Property Values

Microsoft.OperationalInsights/workspaces/dataExports

Name	Description	Value
apiVersion	The api version	'2025-07-01'
name	The resource name	string (required)
properties	data export properties.	DataExportProperties
type	The resource type	'Microsoft.OperationalInsights/workspaces/dataExports'

DataExportProperties

Name	Description	Value
createdDate	The latest data export rule modification time.	string
dataExportId	The data export rule ID.	string
destination	destination properties.	Destination
enable	Active when enabled.	bool
lastModifiedDate	Date and time when the export was last modified.	string
tableNames	An array of tables to export, for example: [“Heartbeat, SecurityEvent”].	string[] (required)

Destination

Name	Description	Value
metaData	destination meta data.	DestinationMetaData
resourceId	The destination resource ID. This can be copied from the Properties entry of the destination resource in Azure.	string (required)

DestinationMetaData

Name	Description	Value
eventHubName	Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account.	string

Usage Examples

Terraform (AzAPI provider) resource definition

The workspaces/dataExports resource type can be deployed with operations that target:

• Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.OperationalInsights/workspaces/dataExports resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.OperationalInsights/workspaces/dataExports@2025-07-01"
  name = "string"
  parent_id = "string"
  body = {
    properties = {
      createdDate = "string"
      dataExportId = "string"
      destination = {
        metaData = {
          eventHubName = "string"
        }
        resourceId = "string"
      }
      enable = bool
      lastModifiedDate = "string"
      tableNames = [
        "string"
      ]
    }
  }
}

Property Values

Microsoft.OperationalInsights/workspaces/dataExports

Name	Description	Value
name	The resource name	string (required)
parent_id	The ID of the resource that is the parent for this resource.	ID for resource of type: workspaces
properties	data export properties.	DataExportProperties
type	The resource type	"Microsoft.OperationalInsights/workspaces/dataExports@2025-07-01"

DataExportProperties

Name	Description	Value
createdDate	The latest data export rule modification time.	string
dataExportId	The data export rule ID.	string
destination	destination properties.	Destination
enable	Active when enabled.	bool
lastModifiedDate	Date and time when the export was last modified.	string
tableNames	An array of tables to export, for example: [“Heartbeat, SecurityEvent”].	string[] (required)

Destination

Name	Description	Value
metaData	destination meta data.	DestinationMetaData
resourceId	The destination resource ID. This can be copied from the Properties entry of the destination resource in Azure.	string (required)

DestinationMetaData

Name	Description	Value
eventHubName	Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account.	string

Usage Examples

Terraform Samples

A basic example of deploying log analytics Data Export Rule.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "storageAccount" {
  type      = "Microsoft.Storage/storageAccounts@2021-09-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    kind = "StorageV2"
    properties = {
      accessTier                   = "Hot"
      allowBlobPublicAccess        = true
      allowCrossTenantReplication  = true
      allowSharedKeyAccess         = true
      defaultToOAuthAuthentication = false
      encryption = {
        keySource = "Microsoft.Storage"
        services = {
          queue = {
            keyType = "Service"
          }
          table = {
            keyType = "Service"
          }
        }
      }
      isHnsEnabled      = false
      isNfsV3Enabled    = false
      isSftpEnabled     = false
      minimumTlsVersion = "TLS1_2"
      networkAcls = {
        defaultAction = "Allow"
      }
      publicNetworkAccess      = "Enabled"
      supportsHttpsTrafficOnly = true
    }
    sku = {
      name = "Standard_LRS"
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "dataExport" {
  type      = "Microsoft.OperationalInsights/workspaces/dataExports@2020-08-01"
  parent_id = azapi_resource.workspace.id
  name      = var.resource_name
  body = {
    properties = {
      destination = {
        resourceId = azapi_resource.storageAccount.id
      }
      enable = false
      tableNames = [
        "Heartbeat",
      ]
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}