Workspaces - Create Or Update

Service:: Log Analytics

API Version:: 2025-02-01

Create or update a workspace.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}?api-version=2025-02-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string minLength: 1	The ID of the target subscription.
workspaceName	path	True	string minLength: 4 maxLength: 63 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Body

Name	Type	Description
parameters	Workspace	The parameters required to create or update a workspace.

Responses

Name	Type	Description
200 OK	Workspace	OK response definition.
201 Created	Workspace	Created response definition.
202 Accepted		Accepted
Other Status Codes	ErrorResponse	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

WorkspacesCreate

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685?api-version=2025-02-01

{
  "properties": {
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30
  },
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  }
}

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.OperationalInsights.Models;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.OperationalInsights;

// Generated from example definition: specification/operationalinsights/resource-manager/Microsoft.OperationalInsights/stable/2025-02-01/examples/WorkspacesCreate.json
// this example is just showing the usage of "Workspaces_CreateOrUpdate" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://free.blessedness.top/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this ResourceGroupResource created on azure
// for more information of creating ResourceGroupResource, please refer to the document of ResourceGroupResource
string subscriptionId = "00000000-0000-0000-0000-00000000000";
string resourceGroupName = "oiautorest6685";
ResourceIdentifier resourceGroupResourceId = ResourceGroupResource.CreateResourceIdentifier(subscriptionId, resourceGroupName);
ResourceGroupResource resourceGroupResource = client.GetResourceGroupResource(resourceGroupResourceId);

// get the collection of this OperationalInsightsWorkspaceResource
OperationalInsightsWorkspaceCollection collection = resourceGroupResource.GetOperationalInsightsWorkspaces();

// invoke the operation
string workspaceName = "oiautorest6685";
OperationalInsightsWorkspaceData data = new OperationalInsightsWorkspaceData(new AzureLocation("australiasoutheast"))
{
    Sku = new OperationalInsightsWorkspaceSku(OperationalInsightsWorkspaceSkuName.PerGB2018),
    RetentionInDays = 30,
    Tags =
    {
    ["tag1"] = "val1"
    },
};
ArmOperation<OperationalInsightsWorkspaceResource> lro = await collection.CreateOrUpdateAsync(WaitUntil.Completed, workspaceName, data);
OperationalInsightsWorkspaceResource result = lro.Value;

// the variable result is a resource, you could call other operations on this instance as well
// but just for demo, we get its data from this resource instance
OperationalInsightsWorkspaceData resourceData = result.Data;
// for demo we just print out the id
Console.WriteLine($"Succeeded on id: {resourceData.Id}");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000005/resourcegroups/oiautorest6685/providers/microsoft.operationalinsights/workspaces/aztest2170",
  "name": "AzTest2170",
  "type": "Microsoft.OperationalInsights/workspaces",
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  },
  "properties": {
    "customerId": "bc089d7b-485c-4aff-a71e-c00f362d8d2f",
    "provisioningState": "Creating",
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30,
    "publicNetworkAccessForQuery": "Enabled",
    "publicNetworkAccessForIngestion": "Enabled"
  }
}

Status code:: 201

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000005/resourcegroups/oiautorest6685/providers/microsoft.operationalinsights/workspaces/aztest2170",
  "name": "AzTest2170",
  "type": "Microsoft.OperationalInsights/workspaces",
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  },
  "properties": {
    "customerId": "bc089d7b-485c-4aff-a71e-c00f362d8d2f",
    "provisioningState": "Creating",
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30,
    "publicNetworkAccessForQuery": "Enabled",
    "publicNetworkAccessForIngestion": "Enabled"
  }
}

Status code:: 202

Definitions

Name	Description
CapacityReservationLevel	The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.
createdByType	The type of identity that created the resource.
DataIngestionStatus	The status of data ingestion for this workspace.
ErrorAdditionalInfo	The resource management error additional info.
ErrorDetail	The error detail.
ErrorResponse	Error response
Identity	The identity of the resource.
IdentityType	Type of managed service identity.
PrivateLinkScopedResource	List of linked private link scope resources.
PublicNetworkAccessType	The network access type for accessing Log Analytics ingestion.
systemData	Metadata pertaining to creation and last modification of the resource.
UserIdentityProperties	User assigned identity properties.
Workspace	The top level Workspace resource container.
WorkspaceCapping	The daily volume cap for ingestion.
WorkspaceEntityStatus	The provisioning state of the workspace.
WorkspaceFailoverProperties	workspace failover properties.
WorkspaceFailoverState	The failover state of the replication.
WorkspaceFeatures	Workspace features.
WorkspaceReplicationProperties	workspace replication properties.
WorkspaceReplicationState	The provisioning state of the replication.
WorkspaceSku	The SKU of the workspace.
WorkspaceSkuNameEnum	The name of the SKU.

CapacityReservationLevel

Enumeration

The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.

Value	Description
100
200
300
400
500
1000
2000
5000
10000
25000
50000

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

DataIngestionStatus

Enumeration

The status of data ingestion for this workspace.

Value	Description
RespectQuota	Ingestion enabled following daily cap quota reset, or subscription enablement.
ForceOn	Ingestion started following service setting change.
ForceOff	Ingestion stopped following service setting change.
OverQuota	Reached daily cap quota, ingestion stopped.
SubscriptionSuspended	Ingestion stopped following suspended subscription.
ApproachingQuota	80% of daily cap quota reached.

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorDetail

Object

The error detail.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorDetail[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorResponse

Object

Error response

Name	Type	Description
error	ErrorDetail	The error object.

Identity

Object

The identity of the resource.

Name	Type	Description
principalId	string	The principal ID of resource identity.
tenantId	string	The tenant ID of resource.
type	IdentityType	Type of managed service identity.
userAssignedIdentities	<string, UserIdentityProperties>	The list of user identities associated with the resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

IdentityType

Enumeration

Type of managed service identity.

Value	Description
SystemAssigned
UserAssigned
None

PrivateLinkScopedResource

Object

List of linked private link scope resources.

Name	Type	Description
resourceId	string	The full resource Id of the private link scope resource.
scopeId	string	The private link scope unique Identifier.

PublicNetworkAccessType

Enumeration

The network access type for accessing Log Analytics ingestion.

Value	Description
Enabled	Enables connectivity to Log Analytics through public DNS.
Disabled	Disables public connectivity to Log Analytics through public DNS.

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

UserIdentityProperties

Object

User assigned identity properties.

Name	Type	Description
clientId	string	The client id of user assigned identity.
principalId	string	The principal id of user assigned identity.

Workspace

Object

The top level Workspace resource container.

Name	Type	Default value	Description
etag	string		The etag of the workspace.
id	string		Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
identity	Identity		The identity of the resource.
location	string		The geo-location where the resource lives
name	string		The name of the resource
properties.createdDate	string (date-time)		Workspace creation date.
properties.customerId	string		This is a read-only property. Represents the ID associated with the workspace.
properties.defaultDataCollectionRuleResourceId	string		The resource ID of the default Data Collection Rule to use for this workspace. Expected format is - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}.
properties.failover	WorkspaceFailoverProperties		workspace failover properties.
properties.features	WorkspaceFeatures		Workspace features.
properties.forceCmkForQuery	boolean		Indicates whether customer managed storage is mandatory for query management.
properties.modifiedDate	string (date-time)		Workspace modification date.
properties.privateLinkScopedResources	PrivateLinkScopedResource[]		List of linked private link scope resources.
properties.provisioningState	WorkspaceEntityStatus		The provisioning state of the workspace.
properties.publicNetworkAccessForIngestion	PublicNetworkAccessType	Enabled	The network access type for accessing Log Analytics ingestion.
properties.publicNetworkAccessForQuery	PublicNetworkAccessType	Enabled	The network access type for accessing Log Analytics query.
properties.replication	WorkspaceReplicationProperties		workspace replication properties.
properties.retentionInDays	integer (int32)		The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details.
properties.sku	WorkspaceSku		The SKU of the workspace.
properties.workspaceCapping	WorkspaceCapping		The daily volume cap for ingestion.
systemData	systemData		Metadata pertaining to creation and last modification of the resource.
tags	object		Resource tags.
type	string		The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

WorkspaceCapping

Object

The daily volume cap for ingestion.

Name	Type	Description
dailyQuotaGb	number (double)	The workspace daily quota for ingestion.
dataIngestionStatus	DataIngestionStatus	The status of data ingestion for this workspace.
quotaNextResetTime	string	The time when the quota will be rest.

WorkspaceEntityStatus

Enumeration

The provisioning state of the workspace.

Value	Description
Creating
Succeeded
Failed
Canceled
Deleting
ProvisioningAccount
Updating

WorkspaceFailoverProperties

Object

workspace failover properties.

Name	Type	Description
lastModifiedDate	string (date-time)	The last time when the failover state was updated.
state	WorkspaceFailoverState	The failover state of the replication.

WorkspaceFailoverState

Enumeration

The failover state of the replication.

Value	Description
Inactive
Activating
Active
Deactivating
Failed

WorkspaceFeatures

Object

Workspace features.

Name	Type	Description
clusterResourceId	string	Dedicated LA cluster resourceId that is linked to the workspaces.
disableLocalAuth	boolean	Disable Non-AAD based Auth.
enableDataExport	boolean	Flag that indicate if data should be exported.
enableLogAccessUsingOnlyResourcePermissions	boolean	Flag that indicate which permission to use - resource or workspace or both.
immediatePurgeDataOn30Days	boolean	Flag that describes if we want to remove the data after 30 days.
unifiedSentinelBillingOnly	boolean	An indication if the specify workspace is limited to sentinel's unified billing model only.

WorkspaceReplicationProperties

Object

workspace replication properties.

Name	Type	Description
createdDate	string (date-time)	The last time when the replication was enabled.
enabled	boolean	Specifies whether the replication is enabled or not. When true, workspace configuration and data is replicated to the specified location. If replication is been enabled, location must be provided.
lastModifiedDate	string (date-time)	The last time when the replication was updated.
location	string	The location of the replication.
provisioningState	WorkspaceReplicationState	The provisioning state of the replication.

WorkspaceReplicationState

Enumeration

The provisioning state of the replication.

Value	Description
Succeeded
EnableRequested
Enabling
DisableRequested
Disabling
RollbackRequested
RollingBack
Failed
Canceled

WorkspaceSku

Object

The SKU of the workspace.

Name	Type	Description
capacityReservationLevel	CapacityReservationLevel (int32)	The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.
lastSkuUpdate	string (date-time)	The last time when the sku was updated.
name	WorkspaceSkuNameEnum	The name of the SKU.

WorkspaceSkuNameEnum

Enumeration

The name of the SKU.

Value	Description
Free
Standard
Premium
PerNode
PerGB2018
Standalone
CapacityReservation
LACluster

Share via

Workspaces - Create Or Update

URI Parameters

Request Body

Responses

Security

azure_auth

Scopes

Examples

WorkspacesCreate

Sample request

Sample response

Definitions

CapacityReservationLevel

createdByType

DataIngestionStatus

ErrorAdditionalInfo

ErrorDetail

ErrorResponse

Identity

IdentityType

PrivateLinkScopedResource

PublicNetworkAccessType

systemData

UserIdentityProperties

Workspace

WorkspaceCapping

WorkspaceEntityStatus

WorkspaceFailoverProperties

WorkspaceFailoverState

WorkspaceFeatures

WorkspaceReplicationProperties

WorkspaceReplicationState

WorkspaceSku

WorkspaceSkuNameEnum