Move a Log Analytics workspace in Azure Monitor

Article
09/11/2024

In this article, you'll learn the steps to move a Log Analytics workspace to another resource group or subscription in the same region. To move a workspace across regions, see Move a Log Analytics workspace to another region.

Tip

To learn more about how to move Azure resources through the Azure portal, PowerShell, the Azure CLI, or the REST API, see Move resources to a new resource group or subscription.

Prerequisites

The subscription or resource group where you want to move your Log Analytics workspace must be located in the same region as the Log Analytics workspace you're moving.
The move operation requires that no services can be linked to the workspace. Prior to the move, delete solutions that rely on linked services, including an Azure Automation account. These solutions must be removed before you can unlink your Automation account. Data collection for the solutions will stop and their tables will be removed from the UI, but data remains in workspace for the retention period defined for table. When you add solutions back after the move, ingestion restored and tables become visible with data. Linked services include:
- Update management
- Change tracking
- Start/Stop VMs during off-hours
- Microsoft Defender for Cloud
Connected Log Analytics agents and Azure Monitor Agent remain connected to the workspace after the move with no interruption to ingestion.
Alerts should be re-created after the move, since permissions for alerts is based on workspace resource ID, which changes with the move. Alerts created after June 1, 2019, or in workspaces that were upgraded from the legacy Log Analytics Alert API to the scheduledQueryRules API can be exported in templates and deployed after the move. You can check if the scheduledQueryRules API is used for alerts in your workspace. Alternatively, you can configure alerts manually in the target workspace.
Update resource paths after a workspace move for Azure or external resources that point to the workspace. For example: Azure Monitor alert rules, Third-party applications, Custom scripting, etc.

Permissions required

Action	Permissions required
Verify the Microsoft Entra tenant.	`Microsoft.AzureActiveDirectory/b2cDirectories/read` permissions, as provided by the Log Analytics Reader built-in role, for example.
Delete a solution.	`Microsoft.OperationsManagement/solutions/delete` permissions on the solution, as provided by the Log Analytics Contributor built-in role, for example.
Remove alert rules for the Start/Stop VMs solution.	`microsoft.insights/scheduledqueryrules/delete` permissions, as provided by the Monitoring Contributor built-in role, for example.
Unlink the Automation account	`Microsoft.OperationalInsights/workspaces/linkedServices/delete` permissions on the linked Log Analytics workspace, as provided by the Log Analytics Contributor built-in role, for example.
Move a Log Analytics workspace.	`Microsoft.OperationalInsights/workspaces/delete` and `Microsoft.OperationalInsights/workspaces/write` permissions on the Log Analytics workspace, as provided by the Log Analytics Contributor built-in role, for example.

Considerations and limits

Consider these points before you move a Log Analytics workspace:

It can take Azure Resource Manager a few hours to complete. Solutions might be unresponsive during the operation.
Managed solutions that are installed in the workspace, will be moved as well.
Managed solutions are workspace's objects and can't be moved independently.
Workspace keys (both primary and secondary) are regenerated with a workspace move operation. If you keep a copy of your workspace keys in Azure Key Vault, update them with the new keys generated after the workspace is moved.

Important

Microsoft Sentinel customers

Currently, after Microsoft Sentinel is deployed on a workspace, moving the workspace to another resource group or subscription isn't supported.
If you've already moved the workspace, disable all active rules under Analytics and reenable them after five minutes. This solution should be effective in most cases, although it's unsupported and undertaken at your own risk.

Verify the Microsoft Entra tenant

The workspace source and destination subscriptions must exist within the same Microsoft tenant. Use Azure PowerShell to verify that both subscriptions have the same Entra tenant ID.

Portal
REST API
CLI
PowerShell

Find your Microsoft Entra tenant for the source and destination subscriptions.

Delete solutions

Portal
REST API
CLI
PowerShell

Open the menu for the resource group where any solutions are installed.
Select the solutions to remove.
Select Delete Resources and then confirm the resources to be removed by selecting Delete.

Remove alert rules for the Start/Stop VMs solution

To remove the Start/Stop VMs solution, you also need to remove the alert rules created by the solution.

Portal
REST API
CLI
PowerShell

Open the Monitor menu and then select Alerts.
Select Manage alert rules.
Select the following three alert rules, and then select Delete:
- AutoStop_VM_Child
- ScheduledStartStop_Parent
- SequencedStartStop_Parent

Unlink the Automation account

Portal
REST API
CLI
PowerShell

See Delete a standalone Automation account linked to workspace.

Move your workspace

Portal
REST API
CLI
PowerShell

Open the Log Analytics workspaces menu and then select your workspace.
On the Overview page, select change next to either Resource group or Subscription name.
A new page opens with a list of resources related to the workspace. Select the resources to move to the same destination subscription and resource group as the workspace.
Select a destination Subscription and Resource group. If you're moving the workspace to another resource group in the same subscription, you won't see the Subscription option.
Select OK to move the workspace and selected resources.