Workspaces - Create Or Update

Create or update a workspace.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}?api-version=2023-09-01

URI Parameters

Name In Required Type Description
resourceGroupName
path True

string

The name of the resource group. The name is case insensitive.

subscriptionId
path True

string

The ID of the target subscription.

workspaceName
path True

string

The name of the workspace.

Regex pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$

api-version
query True

string

The API version to use for this operation.

Request Body

Name Required Type Description
location True

string

The geo-location where the resource lives

etag

string

The etag of the workspace.

identity

Identity

The identity of the resource.

properties.defaultDataCollectionRuleResourceId

string

The resource ID of the default Data Collection Rule to use for this workspace. Expected format is - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}.

properties.features

WorkspaceFeatures

Workspace features.

properties.forceCmkForQuery

boolean

Indicates whether customer managed storage is mandatory for query management.

properties.publicNetworkAccessForIngestion

PublicNetworkAccessType

The network access type for accessing Log Analytics ingestion.

properties.publicNetworkAccessForQuery

PublicNetworkAccessType

The network access type for accessing Log Analytics query.

properties.retentionInDays

integer

The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details.

properties.sku

WorkspaceSku

The SKU of the workspace.

properties.workspaceCapping

WorkspaceCapping

The daily volume cap for ingestion.

tags

object

Resource tags.

Responses

Name Type Description
200 OK

Workspace

OK response definition.

201 Created

Workspace

Created response definition.

202 Accepted

Accepted

Other Status Codes

ErrorResponse

Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name Description
user_impersonation impersonate your user account

Examples

WorkspacesCreate

Sample request

PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000/resourcegroups/oiautorest6685/providers/Microsoft.OperationalInsights/workspaces/oiautorest6685?api-version=2023-09-01

{
  "properties": {
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30
  },
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  }
}

Sample response

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000005/resourcegroups/oiautorest6685/providers/microsoft.operationalinsights/workspaces/aztest2170",
  "name": "AzTest2170",
  "type": "Microsoft.OperationalInsights/workspaces",
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  },
  "properties": {
    "customerId": "bc089d7b-485c-4aff-a71e-c00f362d8d2f",
    "provisioningState": "Creating",
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30,
    "publicNetworkAccessForQuery": "Enabled",
    "publicNetworkAccessForIngestion": "Enabled"
  }
}
{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000005/resourcegroups/oiautorest6685/providers/microsoft.operationalinsights/workspaces/aztest2170",
  "name": "AzTest2170",
  "type": "Microsoft.OperationalInsights/workspaces",
  "location": "australiasoutheast",
  "tags": {
    "tag1": "val1"
  },
  "properties": {
    "customerId": "bc089d7b-485c-4aff-a71e-c00f362d8d2f",
    "provisioningState": "Creating",
    "sku": {
      "name": "PerGB2018"
    },
    "retentionInDays": 30,
    "publicNetworkAccessForQuery": "Enabled",
    "publicNetworkAccessForIngestion": "Enabled"
  }
}

Definitions

Name Description
CapacityReservationLevel

The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.

createdByType

The type of identity that created the resource.

DataIngestionStatus

The status of data ingestion for this workspace.

ErrorAdditionalInfo

The resource management error additional info.

ErrorDetail

The error detail.

ErrorResponse

Error response

Identity

Identity for the resource.

IdentityType

Type of managed service identity.

PrivateLinkScopedResource

The private link scope resource reference.

PublicNetworkAccessType

The network access type for operating on the Log Analytics Workspace. By default it is Enabled

systemData

Metadata pertaining to creation and last modification of the resource.

UserIdentityProperties

User assigned identity properties.

Workspace

The top level Workspace resource container.

WorkspaceCapping

The daily volume cap for ingestion.

WorkspaceEntityStatus

The provisioning state of the workspace.

WorkspaceFeatures

Workspace features.

WorkspaceSku

The SKU (tier) of a workspace.

WorkspaceSkuNameEnum

The name of the SKU.

CapacityReservationLevel

The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.

Name Type Description
100

Integer

1000

Integer

10000

Integer

200

Integer

2000

Integer

25000

Integer

300

Integer

400

Integer

500

Integer

5000

Integer

50000

Integer

createdByType

The type of identity that created the resource.

Name Type Description
Application

string

Key

string

ManagedIdentity

string

User

string

DataIngestionStatus

The status of data ingestion for this workspace.

Name Type Description
ApproachingQuota

string

80% of daily cap quota reached.

ForceOff

string

Ingestion stopped following service setting change.

ForceOn

string

Ingestion started following service setting change.

OverQuota

string

Reached daily cap quota, ingestion stopped.

RespectQuota

string

Ingestion enabled following daily cap quota reset, or subscription enablement.

SubscriptionSuspended

string

Ingestion stopped following suspended subscription.

ErrorAdditionalInfo

The resource management error additional info.

Name Type Description
info

object

The additional info.

type

string

The additional info type.

ErrorDetail

The error detail.

Name Type Description
additionalInfo

ErrorAdditionalInfo[]

The error additional info.

code

string

The error code.

details

ErrorDetail[]

The error details.

message

string

The error message.

target

string

The error target.

ErrorResponse

Error response

Name Type Description
error

ErrorDetail

The error object.

Identity

Identity for the resource.

Name Type Description
principalId

string

The principal ID of resource identity.

tenantId

string

The tenant ID of resource.

type

IdentityType

Type of managed service identity.

userAssignedIdentities

<string,  UserIdentityProperties>

The list of user identities associated with the resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

IdentityType

Type of managed service identity.

Name Type Description
None

string

SystemAssigned

string

UserAssigned

string

PrivateLinkScopedResource

The private link scope resource reference.

Name Type Description
resourceId

string

The full resource Id of the private link scope resource.

scopeId

string

The private link scope unique Identifier.

PublicNetworkAccessType

The network access type for operating on the Log Analytics Workspace. By default it is Enabled

Name Type Description
Disabled

string

Disables public connectivity to Log Analytics through public DNS.

Enabled

string

Enables connectivity to Log Analytics through public DNS.

systemData

Metadata pertaining to creation and last modification of the resource.

Name Type Description
createdAt

string

The timestamp of resource creation (UTC).

createdBy

string

The identity that created the resource.

createdByType

createdByType

The type of identity that created the resource.

lastModifiedAt

string

The timestamp of resource last modification (UTC)

lastModifiedBy

string

The identity that last modified the resource.

lastModifiedByType

createdByType

The type of identity that last modified the resource.

UserIdentityProperties

User assigned identity properties.

Name Type Description
clientId

string

The client id of user assigned identity.

principalId

string

The principal id of user assigned identity.

Workspace

The top level Workspace resource container.

Name Type Default value Description
etag

string

The etag of the workspace.

id

string

Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}

identity

Identity

The identity of the resource.

location

string

The geo-location where the resource lives

name

string

The name of the resource

properties.createdDate

string

Workspace creation date.

properties.customerId

string

This is a read-only property. Represents the ID associated with the workspace.

properties.defaultDataCollectionRuleResourceId

string

The resource ID of the default Data Collection Rule to use for this workspace. Expected format is - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}.

properties.features

WorkspaceFeatures

Workspace features.

properties.forceCmkForQuery

boolean

Indicates whether customer managed storage is mandatory for query management.

properties.modifiedDate

string

Workspace modification date.

properties.privateLinkScopedResources

PrivateLinkScopedResource[]

List of linked private link scope resources.

properties.provisioningState

WorkspaceEntityStatus

The provisioning state of the workspace.

properties.publicNetworkAccessForIngestion

PublicNetworkAccessType

Enabled

The network access type for accessing Log Analytics ingestion.

properties.publicNetworkAccessForQuery

PublicNetworkAccessType

Enabled

The network access type for accessing Log Analytics query.

properties.retentionInDays

integer

The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details.

properties.sku

WorkspaceSku

The SKU of the workspace.

properties.workspaceCapping

WorkspaceCapping

The daily volume cap for ingestion.

systemData

systemData

Metadata pertaining to creation and last modification of the resource.

tags

object

Resource tags.

type

string

The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

WorkspaceCapping

The daily volume cap for ingestion.

Name Type Description
dailyQuotaGb

number

The workspace daily quota for ingestion.

dataIngestionStatus

DataIngestionStatus

The status of data ingestion for this workspace.

quotaNextResetTime

string

The time when the quota will be rest.

WorkspaceEntityStatus

The provisioning state of the workspace.

Name Type Description
Canceled

string

Creating

string

Deleting

string

Failed

string

ProvisioningAccount

string

Succeeded

string

Updating

string

WorkspaceFeatures

Workspace features.

Name Type Description
clusterResourceId

string

Dedicated LA cluster resourceId that is linked to the workspaces.

disableLocalAuth

boolean

Disable Non-AAD based Auth.

enableDataExport

boolean

Flag that indicate if data should be exported.

enableLogAccessUsingOnlyResourcePermissions

boolean

Flag that indicate which permission to use - resource or workspace or both.

immediatePurgeDataOn30Days

boolean

Flag that describes if we want to remove the data after 30 days.

unifiedSentinelBillingOnly

boolean

An indication if the specify workspace is limited to sentinel's unified billing model only.

WorkspaceSku

The SKU (tier) of a workspace.

Name Type Description
capacityReservationLevel

CapacityReservationLevel

The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.

lastSkuUpdate

string

The last time when the sku was updated.

name

WorkspaceSkuNameEnum

The name of the SKU.

WorkspaceSkuNameEnum

The name of the SKU.

Name Type Description
CapacityReservation

string

Free

string

LACluster

string

PerGB2018

string

PerNode

string

Premium

string

Standalone

string

Standard

string