Workspaces - Create Or Update

Service:

Log Analytics

API Version:

2023-09-01

Create or update a workspace.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}?api-version=2023-09-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string	The ID of the target subscription.
workspaceName	path	True	string	The name of the workspace. Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
api-version	query	True	string	The API version to use for this operation.

Request Body

Name	Required	Type	Description
location	True	string	The geo-location where the resource lives
etag		string	The etag of the workspace.
identity		Identity	The identity of the resource.
properties.defaultDataCollectionRuleResourceId		string	The resource ID of the default Data Collection Rule to use for this workspace. Expected format is - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}.
properties.features		WorkspaceFeatures	Workspace features.
properties.forceCmkForQuery		boolean	Indicates whether customer managed storage is mandatory for query management.
properties.publicNetworkAccessForIngestion		PublicNetworkAccessType	The network access type for accessing Log Analytics ingestion.
properties.publicNetworkAccessForQuery		PublicNetworkAccessType	The network access type for accessing Log Analytics query.
properties.retentionInDays		integer	The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details.
properties.sku		WorkspaceSku	The SKU of the workspace.
properties.workspaceCapping		WorkspaceCapping	The daily volume cap for ingestion.
tags		object	Resource tags.

Responses

Name	Type	Description
200 OK	Workspace	OK response definition.
201 Created	Workspace	Created response definition.
202 Accepted		Accepted
Other Status Codes	ErrorResponse	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

WorkspacesCreate

Sample request

HTTP

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685?api-version=2023-09-01

{
  "properties": {
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30
  },
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  }
}

Sample response

Status code:

200

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000005/resourcegroups/oiautorest6685/providers/microsoft.operationalinsights/workspaces/aztest2170",
  "name": "AzTest2170",
  "type": "Microsoft.OperationalInsights/workspaces",
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  },
  "properties": {
    "customerId": "bc089d7b-485c-4aff-a71e-c00f362d8d2f",
    "provisioningState": "Creating",
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30,
    "publicNetworkAccessForQuery": "Enabled",
    "publicNetworkAccessForIngestion": "Enabled"
  }
}

Status code:

201

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000005/resourcegroups/oiautorest6685/providers/microsoft.operationalinsights/workspaces/aztest2170",
  "name": "AzTest2170",
  "type": "Microsoft.OperationalInsights/workspaces",
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  },
  "properties": {
    "customerId": "bc089d7b-485c-4aff-a71e-c00f362d8d2f",
    "provisioningState": "Creating",
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30,
    "publicNetworkAccessForQuery": "Enabled",
    "publicNetworkAccessForIngestion": "Enabled"
  }
}

Status code:

202

Definitions

Name	Description
CapacityReservationLevel	The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.
createdByType	The type of identity that created the resource.
DataIngestionStatus	The status of data ingestion for this workspace.
ErrorAdditionalInfo	The resource management error additional info.
ErrorDetail	The error detail.
ErrorResponse	Error response
Identity	Identity for the resource.
IdentityType	Type of managed service identity.
PrivateLinkScopedResource	The private link scope resource reference.
PublicNetworkAccessType	The network access type for operating on the Log Analytics Workspace. By default it is Enabled
systemData	Metadata pertaining to creation and last modification of the resource.
UserIdentityProperties	User assigned identity properties.
Workspace	The top level Workspace resource container.
WorkspaceCapping	The daily volume cap for ingestion.
WorkspaceEntityStatus	The provisioning state of the workspace.
WorkspaceFeatures	Workspace features.
WorkspaceSku	The SKU (tier) of a workspace.
WorkspaceSkuNameEnum	The name of the SKU.

CapacityReservationLevel

The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.

Name	Type	Description
100	Integer
1000	Integer
10000	Integer
200	Integer
2000	Integer
25000	Integer
300	Integer
400	Integer
500	Integer
5000	Integer
50000	Integer

createdByType

The type of identity that created the resource.

Name	Type	Description
Application	string
Key	string
ManagedIdentity	string
User	string

DataIngestionStatus

The status of data ingestion for this workspace.

Name	Type	Description
ApproachingQuota	string	80% of daily cap quota reached.
ForceOff	string	Ingestion stopped following service setting change.
ForceOn	string	Ingestion started following service setting change.
OverQuota	string	Reached daily cap quota, ingestion stopped.
RespectQuota	string	Ingestion enabled following daily cap quota reset, or subscription enablement.
SubscriptionSuspended	string	Ingestion stopped following suspended subscription.

ErrorAdditionalInfo

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorDetail

The error detail.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorDetail[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorResponse

Error response

Name	Type	Description
error	ErrorDetail	The error object.

Identity

Identity for the resource.

Name	Type	Description
principalId	string	The principal ID of resource identity.
tenantId	string	The tenant ID of resource.
type	IdentityType	Type of managed service identity.
userAssignedIdentities	<string,  UserIdentityProperties>	The list of user identities associated with the resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

IdentityType

Type of managed service identity.

Name	Type	Description
None	string
SystemAssigned	string
UserAssigned	string

PrivateLinkScopedResource

The private link scope resource reference.

Name	Type	Description
resourceId	string	The full resource Id of the private link scope resource.
scopeId	string	The private link scope unique Identifier.

PublicNetworkAccessType

The network access type for operating on the Log Analytics Workspace. By default it is Enabled

Name	Type	Description
Disabled	string	Disables public connectivity to Log Analytics through public DNS.
Enabled	string	Enables connectivity to Log Analytics through public DNS.

systemData

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

UserIdentityProperties

User assigned identity properties.

Name	Type	Description
clientId	string	The client id of user assigned identity.
principalId	string	The principal id of user assigned identity.

Workspace

The top level Workspace resource container.

Name	Type	Default value	Description
etag	string		The etag of the workspace.
id	string		Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
identity	Identity		The identity of the resource.
location	string		The geo-location where the resource lives
name	string		The name of the resource
properties.createdDate	string		Workspace creation date.
properties.customerId	string		This is a read-only property. Represents the ID associated with the workspace.
properties.defaultDataCollectionRuleResourceId	string		The resource ID of the default Data Collection Rule to use for this workspace. Expected format is - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}.
properties.features	WorkspaceFeatures		Workspace features.
properties.forceCmkForQuery	boolean		Indicates whether customer managed storage is mandatory for query management.
properties.modifiedDate	string		Workspace modification date.
properties.privateLinkScopedResources	PrivateLinkScopedResource[]		List of linked private link scope resources.
properties.provisioningState	WorkspaceEntityStatus		The provisioning state of the workspace.
properties.publicNetworkAccessForIngestion	PublicNetworkAccessType	Enabled	The network access type for accessing Log Analytics ingestion.
properties.publicNetworkAccessForQuery	PublicNetworkAccessType	Enabled	The network access type for accessing Log Analytics query.
properties.retentionInDays	integer		The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details.
properties.sku	WorkspaceSku		The SKU of the workspace.
properties.workspaceCapping	WorkspaceCapping		The daily volume cap for ingestion.
systemData	systemData		Metadata pertaining to creation and last modification of the resource.
tags	object		Resource tags.
type	string		The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

WorkspaceCapping

The daily volume cap for ingestion.

Name	Type	Description
dailyQuotaGb	number	The workspace daily quota for ingestion.
dataIngestionStatus	DataIngestionStatus	The status of data ingestion for this workspace.
quotaNextResetTime	string	The time when the quota will be rest.

WorkspaceEntityStatus

The provisioning state of the workspace.

Name	Type	Description
Canceled	string
Creating	string
Deleting	string
Failed	string
ProvisioningAccount	string
Succeeded	string
Updating	string

WorkspaceFeatures

Workspace features.

Name	Type	Description
clusterResourceId	string	Dedicated LA cluster resourceId that is linked to the workspaces.
disableLocalAuth	boolean	Disable Non-AAD based Auth.
enableDataExport	boolean	Flag that indicate if data should be exported.
enableLogAccessUsingOnlyResourcePermissions	boolean	Flag that indicate which permission to use - resource or workspace or both.
immediatePurgeDataOn30Days	boolean	Flag that describes if we want to remove the data after 30 days.
unifiedSentinelBillingOnly	boolean	An indication if the specify workspace is limited to sentinel's unified billing model only.

WorkspaceSku

The SKU (tier) of a workspace.

Name	Type	Description
capacityReservationLevel	CapacityReservationLevel	The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.
lastSkuUpdate	string	The last time when the sku was updated.
name	WorkspaceSkuNameEnum	The name of the SKU.

WorkspaceSkuNameEnum

The name of the SKU.

Name	Type	Description
CapacityReservation	string
Free	string
LACluster	string
PerGB2018	string
PerNode	string
Premium	string
Standalone	string
Standard	string