Why Log Analytics Workspaces Matter

Azure generates massive amounts of log data — from virtual machines, storage accounts, firewalls, to user sign-ins. Without centralization, logs are scattered and difficult to query.

Log Analytics Workspace (LAW) is the central repository for log data in Azure Monitor. It lets you store, query, and analyze logs with the Kusto Query Language (KQL).
As a Solution Architect, you need to design how workspaces are structured, secured, and connected to meet compliance, performance, and cost goals.

Core Concepts

1. What is a Log Analytics Workspace?

• A dedicated environment for collecting and storing log data.

• Resources can be configured to send logs to one or more workspaces.

• Log data can be retained for as little as 30 days or up to 2 years (longer via archive).

2. Kusto Query Language (KQL)

• A rich query language designed for log data.

• Allows filtering, aggregating, and correlating events.

• Example:

   

  SigninLogs
| where ResultType != 0
| summarize FailedAttempts = count() by UserPrincipalName


3. Data Sources

• Azure Activity Logs

• Resource Diagnostics (VMs, Storage, Firewalls)

• Security logs (Entra ID sign-ins, Conditional Access)

• Application Insights telemetry

Designing a Workspace Strategy

1. Centralized vs Distributed Workspaces

• Centralized LAW:

  • One workspace for entire organization.

  • Pros: easier correlation, simpler management.

  • Cons: potential cost and retention complexity.

• Distributed LAW:

  • Separate workspaces for business units or regions.

  • Pros: compliance isolation, cost separation.

  • Cons: harder to correlate logs across environments.

Best Practice: Centralize unless regulatory or scale requirements force separation.

2. Data Retention & Cost

• Default: 30 days.

• Extended retention adds cost but may be required for compliance.

• Archive logs to cheaper storage if not queried often.

3. Access Control

• Use RBAC to control who can query logs.

• Limit sensitive log access (security logs, audit trails).

4. Integration

• Connect with Microsoft Sentinel for SIEM capabilities.

• Integrate with ITSM tools (ServiceNow) for incident tracking.

Example Enterprise Scenario

A multinational bank wants:

• Centralized monitoring of all subscriptions.

• Compliance requires security logs to be retained for 2 years.

• SOC analysts need correlation across all workloads.

Correct design:

• Deploy a centralized Log Analytics Workspace for all subscriptions.

• Enable extended retention for 2 years.

• Connect LAW to Microsoft Sentinel for advanced threat detection.

Confusion Buster

• Activity Log vs Diagnostic Log

  • Activity Log = control plane actions (who created/deleted a resource).

  • Diagnostic Log = resource-level events (data plane, e.g., storage access, firewall rules).

• Log Analytics vs Metrics

  • Logs = detailed, text-based, queried with KQL.

  • Metrics = numeric, real-time, lightweight.

• Log Analytics vs Sentinel

  • LAW = raw log collection + query.

  • Sentinel = SIEM solution that builds on LAW.

Exam Tips

• “Company requires log correlation across subscriptions” → Centralized LAW.

• “Which query language is used in LAW?” → KQL.

• “Long-term log retention for compliance” → LAW extended retention or archive.

• “Connect logs to SIEM solution” → LAW + Sentinel.

What to Expect in the Exam

• Direct Q: “Where are Azure Monitor logs stored?” → Log Analytics Workspace.

• Scenario Q: “Company requires 2-year retention of Entra ID sign-in logs.” → LAW with retention policy.

• Trick Q: “Metrics and Logs are stored in the same place.” → False.