Povratne informacije Uredi

Move a Log Analytics workspace to different subscription or resource group

  • Članak
  • 4 min. za čitanje

In this article, you'll learn the steps to move Log Analytics workspace to another resource group or subscription in the same region. You can learn more about moving Azure resources through the Azure portal, PowerShell, the Azure CLI, or the REST API. at Move resources to a new resource group or subscription.

Important

You can't move a workspace to a different region using this procedure. Follow move a Log Analytics workspace to another region article to move workspace across regions.

Verify Active Directory tenant

The workspace source and destination subscriptions must exist within the same Azure Active Directory tenant. Use Azure PowerShell to verify that both subscriptions have the same tenant ID.

(Get-AzSubscription -SubscriptionName <your-source-subscription>).TenantId
(Get-AzSubscription -SubscriptionName <your-destination-subscription>).TenantId

Workspace move considerations

  • Managed solutions that are installed in the workspace will be moved in this operation.
  • Workspace keys (both primary and secondary) are re-generated with workspace move operation. If you keep a copy of your workspace keys in key vault, update them with the new keys generated after the workspace move.
  • Connected MMA agents will remain connected and keep sending data to the workspace after the move. AMA agents via DCR will be disconnected during the move and should be reconfigured after the move.
  • Since the move operation requires that there are no Linked Services from the workspace, solutions that rely on that link must be removed to allow the workspace move. Solutions that must be removed before you can unlink your automation account:
    • Update Management
    • Change Tracking
    • Start/Stop VMs during off-hours
    • Microsoft Defender for Cloud

Important

Microsoft Sentinel customers

  • Currently, after Microsoft Sentinel is deployed on a workspace, moving the workspace to another resource group or subscription isn't supported.
  • If you have already moved the workspace, disable all active rules under Analytics and re-enable them after five minutes. This should be an effective solution in most cases, though, to reiterate, it is unsupported and undertaken at your own risk.
  • It could take Azure Resource Manager a few hours to complete and solutions may be unresponsive during the operation.

Re-create alerts

Update resource paths

  • After a workspace move, any Azure or external resources that point to the workspace must be reviewed and updated to point to the new resource target path.

    Examples:

Delete solutions in Azure portal

Use the following procedure to remove the solutions using the Azure portal:

  1. Open the menu for the resource group that any solutions are installed in.
  2. Select the solutions to remove.
  3. Click Delete Resources and then confirm the resources to be removed by clicking Delete.

Delete solutions

Delete using PowerShell

To remove the solutions using PowerShell, use the Remove-AzResource cmdlet as shown in the following example:

Remove-AzResource -ResourceType 'Microsoft.OperationsManagement/solutions' -ResourceName "ChangeTracking(<workspace-name>)" -ResourceGroupName <resource-group-name>
Remove-AzResource -ResourceType 'Microsoft.OperationsManagement/solutions' -ResourceName "Updates(<workspace-name>)" -ResourceGroupName <resource-group-name>
Remove-AzResource -ResourceType 'Microsoft.OperationsManagement/solutions' -ResourceName "Start-Stop-VM(<workspace-name>)" -ResourceGroupName <resource-group-name>

Remove alert rules for Start/Stop VMs solution

To remove Start/Stop VMs solution, you also need to remove the alert rules created by the solution. Use the following procedure in the Azure portal to remove these rules.

  1. Open the Monitor menu and then select Alerts.

  2. Click Manage alert rules.

  3. Select the following three alert rules, and then click Delete.

    • AutoStop_VM_Child
    • ScheduledStartStop_Parent
    • SequencedStartStop_Parent

    Delete rules

Use the following procedure to unlink the Automation account from the workspace using the Azure portal:

  1. Open the Automation accounts menu and then select the account to remove.

  2. In the Related Resources section of the menu, select Linked workspace.

  3. Click Unlink workspace to unlink the workspace from your Automation account.

    Unlink workspace

Move your workspace

Azure portal

Use the following procedure to move your workspace using the Azure portal:

  1. Open the Log Analytics workspaces menu and then select your workspace.

  2. In the Overview page, click change next to either Resource group or Subscription.

  3. A new page opens with a list of resources related to the workspace. Select the resources to move to the same destination subscription and resource group as the workspace.

  4. Select a destination Subscription and Resource group. If you're moving the workspace to another resource group in the same subscription, you won't see the Subscription option.

  5. Click OK to move the workspace and selected resources.

    Screenshot shows the Overview pane in the Log Analytics workspace with options to change the resource group and subscription name.

PowerShell

To move your workspace using PowerShell, use the Move-AzResource as in the following example:

Move-AzResource -ResourceId "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup01/providers/Microsoft.OperationalInsights/workspaces/MyWorkspace" -DestinationSubscriptionId "00000000-0000-0000-0000-000000000000" -DestinationResourceGroupName "MyResourceGroup02"

Important

After the move operation, removed solutions and Automation account link should be reconfigured to bring the workspace back to its previous state.

Next steps