While configuring Auditing settings for Azure SQL, the deployment may fail and following error is encountered:
Failed to save Auditing settings for server. The client has permission to perform action 'Microsoft.OperationalInsights/workspaces/sharedKeys/action' on scope '/subscriptions/SubID-ABC/resourceGroups/ResourceGroupName/providers/Microsoft.Sql/servers/ServerName/databases/master/providers/microsoft.insights/diagnosticSettings/workspace', however the current tenant 'XXX' is not authorized to access linked subscription 'SubID-XYZ'.
If you notice in this error, the database referred here is MasterDB which you cannot configure via Portal. Further, Azure SQL and the destination Log Analytics workspace are in different subscriptions as per the error.
While portal does not share the option to manage the MasterDB, and Audit setup does not show any settings configured, the auditing at MasterDB can be checked using PowerShell.
- First, ensure if Portal shows any Audit Settings present at Server Level or at Database Level. Check for Diagnostic settings as well if in case 'SQLSecurityAuditEvents_GUID' is present.
- Then check the settings using PowerShell at both Server and Database Level.
Get-AzSqlServerAudit -ResourceGroupName "YourResourceGroupName" -ServerName "YourServerName"
Get-AzSqlDatabaseAudit -ResourceGroupName "YourResourceGroupName" -ServerName "YourServerName" -DatabaseName "MasterDB"
- Remove this setting stuck at MasterDB carefully.
Remove-AzSQLServerAudit -ResourceGroupName "YourResourceGroupName" -ServerName "YourServerName"
Remove-AzSqlDatabaseAudit -ResourceGroupName "YourResourceGroupName" -ServerName "YourServerName" -DatabaseName "MasterDB"
- Once both Portal and PowerShell show nothing configured for Audit, you can now setup SQL Auditing as per requirement.
- The same steps can also be followed for UserDB and same subscription scenarios if portal is not helping.
These same troubleshooting and remediation steps can also be applied to user databases and to scenarios where Azure SQL resources and audit destinations exist within the same subscription, but the portal does not allow configuration changes due to inconsistent or leftover auditing metadata. From the Azure SQL Database support perspective, this issue most commonly occurs when the user lacks sufficient visibility or permissions on the destination Log Analytics subscription, or when a previous auditing configuration was not fully removed, leaving behind residual settings that interfere with new deployments.
References
Remove-AzSqlDatabaseAudit (Az.Sql) | Microsoft Learn
Remove-AzSqlServerAudit (Az.Sql) | Microsoft Learn
Microsoft