Workspaces - Create Or Update

Service:: Log Analytics

API Version:: 2025-07-01

Create or update a workspace.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}?api-version=2025-07-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string minLength: 1 maxLength: 90	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string minLength: 1	The ID of the target subscription.
workspaceName	path	True	string minLength: 4 maxLength: 63 pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$	The name of the workspace.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Body

Name	Type	Description
parameters	Workspace	The parameters required to create or update a workspace.

Responses

Name	Type	Description
200 OK	Workspace	OK response definition.
201 Created	Workspace	Created response definition.
202 Accepted		Accepted
Other Status Codes	ErrorResponse	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

WorkspacesCreate

Sample request

HTTP

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685?api-version=2025-07-01

{
  "properties": {
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30
  },
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  }
}

Sample response

Status code:: 200

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000005/resourcegroups/oiautorest6685/providers/microsoft.operationalinsights/workspaces/aztest2170",
  "name": "AzTest2170",
  "type": "Microsoft.OperationalInsights/workspaces",
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  },
  "properties": {
    "customerId": "bc089d7b-485c-4aff-a71e-c00f362d8d2f",
    "provisioningState": "Creating",
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30,
    "publicNetworkAccessForQuery": "Enabled",
    "publicNetworkAccessForIngestion": "Enabled"
  }
}

Status code:: 201

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000005/resourcegroups/oiautorest6685/providers/microsoft.operationalinsights/workspaces/aztest2170",
  "name": "AzTest2170",
  "type": "Microsoft.OperationalInsights/workspaces",
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  },
  "properties": {
    "customerId": "bc089d7b-485c-4aff-a71e-c00f362d8d2f",
    "provisioningState": "Creating",
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30,
    "publicNetworkAccessForQuery": "Enabled",
    "publicNetworkAccessForIngestion": "Enabled"
  }
}

Status code:: 202

Definitions

Name	Description
createdByType	The type of identity that created the resource.
DataIngestionStatus	The status of data ingestion for this workspace.
ErrorAdditionalInfo	The resource management error additional info.
ErrorDetail	The error detail.
ErrorResponse	Error response
Identity	Identity for the resource.
PrivateLinkScopedResource	List of linked private link scope resources.
PublicNetworkAccessType	The network access type for accessing Log Analytics ingestion.
ResourceIdentityType	The identity type.
systemData	Metadata pertaining to creation and last modification of the resource.
Workspace	The top level Workspace resource container.
WorkspaceCapping	The daily volume cap for ingestion.
WorkspaceEntityStatus	The provisioning state of the workspace.
WorkspaceFailoverProperties	workspace failover properties.
WorkspaceFailoverState	The failover state of the replication.
WorkspaceFeatures	Workspace features.
WorkspaceReplicationProperties	workspace replication properties.
WorkspaceReplicationState	The provisioning state of the replication.
WorkspaceSku	The SKU of the workspace.
WorkspaceSkuNameEnum	The name of the SKU.

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

DataIngestionStatus

Enumeration

The status of data ingestion for this workspace.

Value	Description
RespectQuota	Ingestion enabled following daily cap quota reset, or subscription enablement.
ForceOn	Ingestion started following service setting change.
ForceOff	Ingestion stopped following service setting change.
OverQuota	Reached daily cap quota, ingestion stopped.
SubscriptionSuspended	Ingestion stopped following suspended subscription.
ApproachingQuota	80% of daily cap quota reached.

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorDetail

Object

The error detail.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorDetail[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorResponse

Object

Error response

Name	Type	Description
error	ErrorDetail	The error object.

Identity

Object

Identity for the resource.

Name	Type	Description
principalId	string (uuid)	The principal ID of resource identity. The value must be an UUID.
tenantId	string (uuid)	The tenant ID of resource. The value must be an UUID.
type	ResourceIdentityType	The identity type.

PrivateLinkScopedResource

Object

List of linked private link scope resources.

Name	Type	Description
resourceId	string	The full resource Id of the private link scope resource.
scopeId	string	The private link scope unique Identifier.

PublicNetworkAccessType

Enumeration

The network access type for accessing Log Analytics ingestion.

Value	Description
Enabled	Enables connectivity to Log Analytics through public DNS.
Disabled	Disables public connectivity to Log Analytics through public DNS.
SecuredByPerimeter	Resource is only accessible from private networks and access approved by network security perimeter associated to this resource.

ResourceIdentityType

Enumeration

The identity type.

Value	Description
SystemAssigned

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

Workspace

Object

The top level Workspace resource container.

Name	Type	Default value	Description
etag	string		The etag of the workspace.
id	string		Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
identity	Identity		The identity of the resource.
location	string		The geo-location where the resource lives
name	string		The name of the resource
properties.createdDate	string (date-time)		Workspace creation date.
properties.customerId	string		This is a read-only property. Represents the ID associated with the workspace.
properties.defaultDataCollectionRuleResourceId	string		The resource ID of the default Data Collection Rule to use for this workspace. Expected format is - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}.
properties.failover	WorkspaceFailoverProperties		workspace failover properties.
properties.features	WorkspaceFeatures		Workspace features.
properties.forceCmkForQuery	boolean		Indicates whether customer managed storage is mandatory for query management.
properties.modifiedDate	string (date-time)		Workspace modification date.
properties.privateLinkScopedResources	PrivateLinkScopedResource[]		List of linked private link scope resources.
properties.provisioningState	WorkspaceEntityStatus		The provisioning state of the workspace.
properties.publicNetworkAccessForIngestion	PublicNetworkAccessType	Enabled	The network access type for accessing Log Analytics ingestion.
properties.publicNetworkAccessForQuery	PublicNetworkAccessType	Enabled	The network access type for accessing Log Analytics query.
properties.replication	WorkspaceReplicationProperties		workspace replication properties.
properties.retentionInDays	integer (int32)		The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details.
properties.sku	WorkspaceSku		The SKU of the workspace.
properties.workspaceCapping	WorkspaceCapping		The daily volume cap for ingestion.
systemData	systemData		Metadata pertaining to creation and last modification of the resource.
tags	object		Resource tags.
type	string		The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

WorkspaceCapping

Object

The daily volume cap for ingestion.

Name	Type	Description
dailyQuotaGb	number (double)	The workspace daily quota for ingestion.
dataIngestionStatus	DataIngestionStatus	The status of data ingestion for this workspace.
quotaNextResetTime	string	The time when the quota will be rest.

WorkspaceEntityStatus

Enumeration

The provisioning state of the workspace.

Value	Description
Creating
Succeeded
Failed
Canceled
Deleting
ProvisioningAccount
Updating

WorkspaceFailoverProperties

Object

workspace failover properties.

Name	Type	Description
lastModifiedDate	string (date-time)	The last time when the failover state was updated.
state	WorkspaceFailoverState	The failover state of the replication.

WorkspaceFailoverState

Enumeration

The failover state of the replication.

Value	Description
Inactive
Activating
Active
Deactivating
Failed

WorkspaceFeatures

Object

Workspace features.

Name	Type	Description
associations	string[]	List of associations for the workspace. Indicates if the workspace is associated with any of the following experiences: MDC, Sentinel, SentinelGraph, etc.
clusterResourceId	string	Dedicated LA cluster resourceId that is linked to the workspaces.
disableLocalAuth	boolean	Disable Non-AAD based Auth.
enableDataExport	boolean	Flag that indicate if data should be exported.
enableLogAccessUsingOnlyResourcePermissions	boolean	Flag that indicate which permission to use - resource or workspace or both.
immediatePurgeDataOn30Days	boolean	Flag that describes if we want to remove the data after 30 days.
unifiedSentinelBillingOnly	boolean	An indication if the specify workspace is limited to sentinel's unified billing model only.

WorkspaceReplicationProperties

Object

workspace replication properties.

Name	Type	Description
createdDate	string (date-time)	The last time when the replication was enabled.
enabled	boolean	Specifies whether the replication is enabled or not. When true, workspace configuration and data is replicated to the specified location. If replication is been enabled, location must be provided.
lastModifiedDate	string (date-time)	The last time when the replication was updated.
location	string	The location of the replication.
provisioningState	WorkspaceReplicationState	The provisioning state of the replication.

WorkspaceReplicationState

Enumeration

The provisioning state of the replication.

Value	Description
Succeeded
EnableRequested
Enabling
DisableRequested
Disabling
RollbackRequested
RollingBack
Failed
Canceled

WorkspaceSku

Object

The SKU of the workspace.

Name	Type	Description
capacityReservationLevel	integer (int32)	The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.
lastSkuUpdate	string (date-time)	The last time when the sku was updated.
name	WorkspaceSkuNameEnum	The name of the SKU.

WorkspaceSkuNameEnum

Enumeration

The name of the SKU.

Value	Description
Free
Standard
Premium
PerNode
PerGB2018
Standalone
CapacityReservation
LACluster

Share via

Workspaces - Create Or Update

URI Parameters

Request Body

Responses

Security

azure_auth

Scopes

Examples

WorkspacesCreate

Sample request

Sample response

Definitions

createdByType

DataIngestionStatus

ErrorAdditionalInfo

ErrorDetail

ErrorResponse

Identity

PrivateLinkScopedResource

PublicNetworkAccessType

ResourceIdentityType

systemData

Workspace

WorkspaceCapping

WorkspaceEntityStatus

WorkspaceFailoverProperties

WorkspaceFailoverState

WorkspaceFeatures

WorkspaceReplicationProperties

WorkspaceReplicationState

WorkspaceSku

WorkspaceSkuNameEnum