Forum Discussion
Solved
Permanently deleted log analytics workspace in Azure and how to recover it ?
Have permanently deleted log analytics workspace in Azure environment and need to recover the deleted workspace.
Reason# Recreated a new log analytics workspace but when tried to check under conditional access --> Insights and reporting
receiving an error message as insufficient permission and highlighting the deleted log analytics workspace.
/subscriptions/xxxxxxxxxxxxxxxxx/resourceGroups/rg-test-prod-uks-001/providers/Microsoft.OperationalInsights/workspaces/
Error code showing : 403 | Content : NewLogAnalyticsBlade
Any idea on how to recover the deleted one or how to fix this permission issue.
Impact: Not able to get audit logs from Conditional access policies to Log analytics workspace.
Thanks.
- Hi all,
Just to let you know, the issue was resolved without reaching Microsoft support.
Once the new log analytics workspace was created, a new diagnostic settings was added enabling the required audit logs.
Have to again navigate to Entra ID Home page --> Monitoring ---> Diagnostic settings ---> able to find the deleted workspace related diagnostic settings.
Navigate to edit settings ---> Under Destination details --> log analytics dropdown --> able to view newly created diagnostic settings --> mapped the new one and clicked "save".
Now, it started to pick the newly created diagnostic settings with new log analytics workspace.
Refreshed the page once and checked under Conditional access policies --> Insights and reporting --> able to view diagnostic details mapped with new workspace and permission related errors have disappeared, Issue resolved and able to view the audit logs now.
3 Replies
- Hi all,
Just to let you know, the issue was resolved without reaching Microsoft support.
Once the new log analytics workspace was created, a new diagnostic settings was added enabling the required audit logs.
Have to again navigate to Entra ID Home page --> Monitoring ---> Diagnostic settings ---> able to find the deleted workspace related diagnostic settings.
Navigate to edit settings ---> Under Destination details --> log analytics dropdown --> able to view newly created diagnostic settings --> mapped the new one and clicked "save".
Now, it started to pick the newly created diagnostic settings with new log analytics workspace.
Refreshed the page once and checked under Conditional access policies --> Insights and reporting --> able to view diagnostic details mapped with new workspace and permission related errors have disappeared, Issue resolved and able to view the audit logs now. - Hi all,
Just to let you know, the issue was resolved without reaching Microsoft support.
Once the new log analytics workspace was created, a new diagnostic settings was added enabling the required audit logs.
Have to again navigate to Entra ID Home page --> Monitoring ---> Diagnostic settings ---> able to find the deleted workspace related diagnostic settings.
Navigate to edit settings ---> Under Destination details --> log analytics dropdown --> able to view newly created diagnostic settings --> mapped the new one and clicked "save".
Now, it started to pick the newly created diagnostic settings with new log analytics workspace.
Refreshed the page once and checked under Conditional access policies --> Insights and reporting --> able to view diagnostic details mapped with new workspace and permission related errors have disappeared, Issue resolved and able to view the audit logs now.
