Azure Monitor Auxiliary Logs expands with Azure tables support, plan switching, and sovereign clouds

Three long-standing customer requests for the Auxiliary table plan in Log Analytics are now generally available:

• Azure table support. Auxiliary now covers a subset of standard Azure tables, selected by ingestion pattern, in addition to DCR-based custom tables (_CL).
• In-place plan switching. You can switch existing tables between the Analytics and Auxiliary plans without recreating them.
• Sovereign cloud availability. Auxiliary Logs is GA in Azure Government (Fairfax) and Microsoft Azure operated by 21Vianet (Mooncake)..

Together, these changes make Auxiliary practical to adopt on the tables you already have, and in the clouds where your workloads already run. And because plan switching is fully reversible, you can try the more cost-effective option with confidence - if it is not the right fit, switch back with no data loss and no disruption.

Why this matters

The Auxiliary plan is built for high-volume, low-touch data - verbose logs, audit trails, and network traffic you retain for compliance but rarely query. Until now, three constraints kept many teams from adopting it broadly.

First, Auxiliary was only available on DCR-based custom tables (_CL). If the data you wanted on Auxiliary already had a standard table, you had no way to route it there. Teams either kept paying Analytics rates for low-touch data, or built custom pipelines to reshape standard data into custom tables. Both paths added cost and complexity. 

Second, the Auxiliary plan was selected when the table was created. If a table's usage pattern changed, you had to recreate it and migrate data to switch plans. So teams naturally wanted the flexibility to adjust a table's plan as its role evolved.

Third, Auxiliary wasn't yet available in the sovereign clouds, so public-sector and regulated workloads couldn't take advantage of it.

This release addresses all three.

Auxiliary on Azure tables

Why is this needed?

• Many of the largest-volume tables in Log Analytics are standard tables that customers can't redirect into custom tables without losing schema and tooling support.
• Teams running Microsoft Sentinel and Azure Monitor side-by-side need to retain verbose standard-table data for compliance and investigation. Paying full Analytics rates for that data isn't viable at scale.
• Forcing standard data through custom-table pipelines added engineering overhead and broke built-in queries and content packs that depend on standard table names.

What does this feature do?

• You can now configure a subset of standard Azure tables on the Auxiliary plan, in addition to DCR-based custom tables. Eligibility is determined per table based on its ingestion pattern, similar to how the Basic plan defines its supported-tables list.
• For the current list of standard tables that support the Auxiliary plan, see Tables that support the Auxiliary table plan in Azure Monitor Logs.
• Standard-table data on Auxiliary keeps its original table name and schema, so existing KQL and integrations continue to work within Auxiliary's query model.
• You get the same Auxiliary ingestion economics and long-term retention behavior that already applied to custom tables.

Switching between Analytics and Auxiliary plans

Why is this needed?

• Table usage patterns shift over time. High-signal Analytics tables can become verbose, and low-touch Auxiliary tables can become central to detections.
• Recreating table data just to change a table's plan is time-consuming and error-prone.
• Customers asked for the same plan-switching flexibility they already have between Analytics and Basic.

What does this feature do?

• You can switch existing tables between the Analytics and Auxiliary plans without recreating them.
• The change applies to the existing table in place, so you keep history, schema, and integrations.
• This brings Auxiliary in line with the plan-switching experience already available for Basic. You can tune cost and query performance per table as your workload evolves.

Auxiliary GA in sovereign clouds

What's available

• Auxiliary Logs is GA in the sovereign clouds: Azure Government (Fairfax) and Microsoft Azure operated by 21Vianet (Mooncake).
• You can create DCR-based custom tables (_CL) on the Auxiliary plan in sovereign cloud workspaces.
• The same long-term retention behavior, query model, and pricing posture that apply to Auxiliary in commercial Azure apply in the sovereign clouds.

What's in this first stage, and what comes next

In this initial stage, Auxiliary in the sovereign clouds ships with the existing Auxiliary functionality. The Azure tables and plan-switching capabilities above will reach these clouds after a stabilization period in public clouds.

What this unlocks together

Together, these capabilities change how you adopt Auxiliary. You no longer have to redesign your ingestion pipeline to take advantage of Auxiliary pricing on standard data. You no longer have to commit to a plan choice at table-creation time. And public-sector workloads in the sovereign clouds can now use the same low-cost retention tier as commercial Azure. Start a table on Analytics for active investigation. Move it to Auxiliary once it transitions to a retention-and-audit role, without losing data or rewriting queries.

Getting started

All capabilities described above are generally available today, with the sovereign clouds scoped to the existing Auxiliary functionality as noted.

• For an overview of how the Auxiliary, Basic, and Analytics plans compare, see Azure Monitor Logs overview: table plans.
• For the list of standard tables that support the Auxiliary plan, see Tables that support the Auxiliary table plan in Azure Monitor Logs.
• To set or switch a table's plan, see Select a table plan based on data usage in a Log Analytics workspace.
• To query Auxiliary data, see Query data in a Basic and Auxiliary table in Azure Monitor Logs.

What's next

Auxiliary is a strategic, long-term investment for Azure Monitor. As data volumes keep growing, we believe every team should be able to keep the logs they need without compromising on cost, and the Auxiliary plan is central to how we deliver that. The capabilities in this release are one step in a broader roadmap to make low-cost logging a first-class experience: as capable, as flexible, and as well-integrated as the rest of Azure Monitor Logs.

We're continuing to invest heavily in the plan, guided directly by customer feedback. Coming next:

• Multi-table queries. Query across multiple tables in a single query, so you can join and correlate Auxiliary data without moving it.
• Broader table coverage. Support for more standard Azure tables on the Auxiliary plan. Table feature support is added regularly, check this article for updates.

Share your feedback as we continue to extend Auxiliary to more tables and more capabilities.