Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article answers common questions about the Logs and Alerting feature. For an overview of what the feature does, see the Logs and Alerting overview.
Is Logs and Alerting generally available?
No. The feature is in preview and rolling out to tenants on an allow-list. If it doesn't appear in your Universal Print admin portal, contact your Microsoft representative to confirm availability for your tenant.
Can I use a Log Analytics workspace I already have?
Yes. You can point the feature at an existing Log Analytics workspace instead of creating a new one — the deployment adds the three custom tables and a Data Collection Rule (DCR) to it and grants Universal Print's service principal the ingestion role (Monitoring Metrics Publisher on the DCR). The workspace must be in the same Microsoft Entra tenant where Universal Print is used. See Set up Logs and Alerting.
Can I send the data to more than one workspace?
No. Each tenant sends telemetry to a single workspace and DCR at a time. To change the destination, update the configuration on the Logs and alerts page in the admin portal (Edit Settings).
Can I change the workspace or DCR after I enable the feature?
Yes. Open Universal Print > Logs and alerts in the Azure portal, select Edit Settings, and point the feature at the new workspace or DCR. The new destination must already have the tables, DCR, and ingestion roles in place (deploy the infrastructure there first).
Why does Universal Print need its service principal Object ID?
Universal Print is a Microsoft first-party application that exists in every tenant as a service principal. During setup, the deployment grants that service principal the Monitoring Metrics Publisher role on your Data Collection Rule so Universal Print can write telemetry into your workspace. The Object ID identifies that service principal in your tenant (a different GUID per tenant), so the role assignment targets the right identity. See Step 1 for how to find it.
How much does it cost?
There's no separate Universal Print charge for the telemetry. Because the workspace is yours, you pay Azure Monitor's standard ingestion and retention charges directly to Azure. Cost scales with how much data you ingest and how long you retain it. See Plan for cost and retention and Azure Monitor Logs cost calculations and options.
Who can see the data?
Only the people you grant access to. The telemetry lands in your own workspace, so you control who can read it with Azure RBAC on the workspace. The data includes operational metadata such as the user who submitted a job and printer location — see Security and privacy considerations.
How long does data take to appear?
Telemetry normally appears within a few minutes of the underlying event. Allow extra time right after you first enable the feature — the first records can take several minutes, and billing records arrive on a periodic roll-up rather than in real time. The three custom tables are created by the deployment, so they exist before any data arrives but stay empty until the first upload succeeds. If data isn't showing up, see No data or delayed data.
How do I turn the feature off?
Disable it from the admin portal without deleting your Azure resources — see Disable the feature. Data already ingested remains in your workspace until it ages out or you delete it. To remove the Azure resources entirely, see Clean up Logs and Alerting.
Is the feature available in government or sovereign clouds?
Not yet. Logs and Alerting is currently available in the Azure Public (commercial) cloud only. Support for government and sovereign clouds — Azure US Government (GCC High, DoD) and Azure China (21Vianet) — isn't available during the current preview and is planned for a future release. Check back here, or contact your Microsoft representative for the latest availability.
Where is my data stored, and does the workspace region matter?
Your telemetry resides in the Log Analytics workspace you choose, in whatever Azure region that workspace was created in — Universal Print writes to your workspace and doesn't keep a separate copy. If you have data-residency requirements, create or select a workspace in a region that meets them before you deploy. The workspace must be in the same Microsoft Entra tenant as Universal Print, but it doesn't have to match the region where your printers are registered.
How is this different from the existing Universal Print reports?
The built-in Reports in the Universal Print admin portal give you aggregated usage summaries inside the portal. Logs and Alerting instead streams raw, per-event telemetry into your own Log Analytics workspace so you can write custom KQL queries, build workbooks and dashboards, set up alert rules, and retain the data on your own schedule. The two are complementary — Logs and Alerting doesn't replace the Reports blade.
Will I see data from before I enabled the feature?
No. There's no historical backfill. Telemetry is captured from the point the feature is enabled forward, so only events that occur after you enable it appear in your workspace.
What happens when I deselect a log category, or disable and re-enable the feature?
Deselecting a category (for example, Job Activity) stops new records for that category from being ingested; records already in the workspace are unaffected and remain until they age out. Re-selecting the category resumes ingestion from that point forward — the gap while it was deselected isn't backfilled. Disabling the feature stops all ingestion, and re-enabling resumes it going forward with the same no-backfill behavior.