SOLVED

How can I automate connecting new subscriptions to a central Log Analytics Workspace?

%3CLINGO-SUB%20id%3D%22lingo-sub-1002857%22%20slang%3D%22en-US%22%3EHow%20can%20I%20automate%20connecting%20new%20subscriptions%20to%20a%20central%20Log%20Analytics%20Workspace%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1002857%22%20slang%3D%22en-US%22%3E%3CP%3EOur%20organization%20has%20a%20single%20Log%20Analytics%20Workspace%20that%20all%20our%20subscriptions%20are%20connected%20and%20sending%20their%20logs%20to.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECurrently%20we%20must%20browse%20to%20that%20LA%20blade%20in%20the%20portal%2C%20click%20Azure%20Activity%20Log%2C%20find%20the%20subscription%20and%20the%20click%20Connect%20on%20the%20new%20blade.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20to%20automate%20this%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1002857%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAutomation%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EAzure%20Log%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1003157%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20I%20automate%20connecting%20new%20subscriptions%20to%20a%20central%20Log%20Analytics%20Workspace%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1003157%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F455511%22%20target%3D%22_blank%22%3E%40AWSullivan%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20will%20need%20to%20know%20the%20workspace%20ID.%20Then%20use%20PowerShell.%26nbsp%3B%3C%2FP%3E%3CP%3EAzure%20AZ%20module%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Faz.operationalinsights%2Fnew-azoperationalinsightsazureactivitylogdatasource%3Fview%3Dazps-3.0.0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Faz.operationalinsights%2Fnew-azoperationalinsightsazureactivitylogdatasource%3Fview%3Dazps-3.0.0%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENew-AzOperationalInsightsAzureActivityLogDataSource%20-ResourceGroupName%20%3CLOGANALYTICSOMSWORKSPACERESOURCEGROUPNAME%3E%20-WorkspaceName%20%3CLOGANALYTICSOMSWORKSPACENAME%3E%20-Name%20%3CNAMEOFTHISOPERATIONALINSIGHTSAZUREACTIVITYLOGDATASOURCE%3E%20-SubscriptionId%20%3CSUBSCRIPTION%3E%3C%2FSUBSCRIPTION%3E%3C%2FNAMEOFTHISOPERATIONALINSIGHTSAZUREACTIVITYLOGDATASOURCE%3E%3C%2FLOGANALYTICSOMSWORKSPACENAME%3E%3C%2FLOGANALYTICSOMSWORKSPACERESOURCEGROUPNAME%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAzureRM%20module%3A%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fazurerm.operationalinsights%2FNew-AzureRmOperationalInsightsAzureActivityLogDataSource%3Fview%3Dazurermps-6.13.0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fpowershell%2Fmodule%2Fazurerm.operationalinsights%2FNew-AzureRmOperationalInsightsAzureActivityLogDataSource%3Fview%3Dazurermps-6.13.0%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENew-AzureRmOperationalInsightsAzureActivityLogDataSource%20-ResourceGroupName%20%3CLOGANALYTICSOMSWORKSPACERESOURCEGROUPNAME%3E%20-WorkspaceName%20%3CLOGANALYTICSOMSWORKSPACENAME%3E%20-Name%20%3CNAMEOFTHISOPERATIONALINSIGHTSAZUREACTIVITYLOGDATASOURCE%3E%20-SubscriptionId%20%3CSUBSCRIPTION%3E%3C%2FSUBSCRIPTION%3E%3C%2FNAMEOFTHISOPERATIONALINSIGHTSAZUREACTIVITYLOGDATASOURCE%3E%3C%2FLOGANALYTICSOMSWORKSPACENAME%3E%3C%2FLOGANALYTICSOMSWORKSPACERESOURCEGROUPNAME%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECheers%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECraig%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1011161%22%20slang%3D%22en-US%22%3ERe%3A%20How%20can%20I%20automate%20connecting%20new%20subscriptions%20to%20a%20central%20Log%20Analytics%20Workspace%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1011161%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F102871%22%20target%3D%22_blank%22%3E%40Craig%20Wilson%3C%2FA%3E%26nbsp%3BThanks%20for%20the%20response.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20is%20a%20great%20option%20for%20us.%20Do%20you%20know%20if%20this%20can%20be%20enforced%20with%20a%20DINE%20policy%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Our organization has a single Log Analytics Workspace that all our subscriptions are connected and sending their logs to.

 

Currently we must browse to that LA blade in the portal, click Azure Activity Log, find the subscription and the click Connect on the new blade.

 

Is there a way to automate this?

 

Thanks!

2 Replies
Highlighted
Solution

@AWSullivan 

You will need to know the workspace ID. Then use PowerShell. 

Azure AZ module:

https://docs.microsoft.com/en-us/powershell/module/az.operationalinsights/new-azoperationalinsightsa...

 

New-AzOperationalInsightsAzureActivityLogDataSource -ResourceGroupName <LogAnalyticsOMSWorkspaceResourceGroupName> -WorkspaceName <LogAnalyticsOMSWorkspaceName> -Name <NameOfThisOperationalInsightsAzureActivityLogDataSource> -SubscriptionId <Subscription>

 

AzureRM module:

https://docs.microsoft.com/en-us/powershell/module/azurerm.operationalinsights/New-AzureRmOperationa...

 

New-AzureRmOperationalInsightsAzureActivityLogDataSource -ResourceGroupName <LogAnalyticsOMSWorkspaceResourceGroupName> -WorkspaceName <LogAnalyticsOMSWorkspaceName> -Name <NameOfThisOperationalInsightsAzureActivityLogDataSource> -SubscriptionId <Subscription>

 

 

Cheers

 

Craig

 

 

Highlighted

@Craig Wilson Thanks for the response.

 

This is a great option for us. Do you know if this can be enforced with a DINE policy?