You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Gauge your current knowledge
Gauge your current knowledge
A Log Analytics Workspace acts as the central data store where Azure Monitor collects and stores telemetry from cloud and on-premises resources. Administrators must choose a pricing model, selecting between Pay-as-you-go for flexibility or Commitment Tiers that offer discounts for ingesting at least 100 GB daily. Consolidating data into a single workspace helps reach commitment tier thresholds faster and reduces the administrative burden of managing multiple workspaces.
The cost and capabilities of stored logs depend on Table Plans. The Analytics plan provides full query and alerting features for high-value data, while the Basic and Auxiliary plans offer lower costs for debugging or compliance storage. Retention policies can be set interactively for immediate querying or configured for Long-term retention reaching up to 12 years for regulatory requirements.
Data flows into the workspace through two main pathways: Diagnostic Settings capture Azure platform logs, while the Azure Monitor Agent (AMA) collects guest operating system data from virtual machines. Both methods use Data Collection Rules (DCRs) to define what data gets gathered and where it goes. Key log sources include Azure Activity Logs for subscription-level events, Resource Logs for service-specific operational data, and Custom Logs ingested via the Logs Ingestion API.
Access to log data is controlled through the Access Control Mode, which determines how users authenticate to view data. Workspace-context permissions grant access to the entire workspace, while Resource-context RBAC allows users to see logs only for resources they already own. For sensitive data, Table-level RBAC can restrict access to specific security tables while keeping operational data visible.
To maintain a healthy environment, administrators use Log Analytics Workspace Insights to track ingestion trends and identify cost-saving opportunities. A Daily Cap can prevent budget overruns by stopping collection once a limit is reached, though this should be used carefully to avoid losing critical monitoring data.
Log data moves through a lifecycle that begins with interactive retention in the workspace, where it can be queried immediately using Kusto Query Language. Administrators can set different retention periods for specific data types or move older data to long-term retention reaching up to 12 years. When archiving to an Azure Storage Account, a lifecycle management policy automates when data moves to cheaper storage tiers or gets deleted.
Continuous export automatically streams log data to Azure Event Hubs or Azure Storage Accounts as it arrives, enabling integration with third-party SIEM systems or external analytics platforms. Export destinations must reside in the same region as the workspace to function properly. Administrators should avoid exporting to the same storage account being monitored, as this creates recursive logging that inflates data volumes.
The choice of Table Plans affects export capabilities. The Analytics plan works best for data used in active alerting, while the Basic plan reduces ingestion costs for troubleshooting logs. The Auxiliary plan provides a cost-effective solution for meeting compliance requirements on large data volumes with limited query needs.
Compliance requirements are met through features like immutable storage, which prevents data alteration during a set period, and Customer-managed keys (CMK) for encryption. Azure Private Link restricts workspace access to authorized networks, preventing data exposure to the public internet.
Monitoring export health involves tracking Azure Monitor metrics for Bytes Exported and Export Failures. Alerts on these metrics enable proactive responses such as increasing storage limits, enabling Auto-inflate on Event Hubs, or splitting high-volume tables across multiple export rules to distribute load.
Diagnostic settings determine which logs and metrics Azure Monitor collects from resources, making them essential for effective monitoring. These settings define the data categories to capture and where that data gets sent, enabling troubleshooting, security analysis, and compliance reporting.
The primary logging destination options include Log Analytics workspace for advanced querying, Azure Storage Account for long-term archival, and Azure Event Hubs for real-time streaming to external systems. Each destination serves different needs: workspace analysis, compliance storage, or integration with security tools.
Enabling diagnostic logging requires navigating to the resource in the Azure portal and accessing its Diagnostic settings panel. Here, administrators select the log categories needed—such as activity logs, resource logs, and metrics—and specify the destination for storage. The workspace must be in a supported region, and destinations should remain within the same network security perimeter as the source resource to maintain log flow.
Proper configuration also involves setting retention policies that balance cost against compliance requirements. Longer retention increases storage costs but may be necessary for regulatory compliance, while shorter retention reduces expenses but may limit investigation capabilities.
For automation, administrators can use PowerShell cmdlets to configure diagnostic settings at scale. Telemetry settings can be tuned by adjusting log levels and sampling rates, ensuring critical information gets captured without overwhelming storage and processing resources.
StudyCerts
StudyCerts