Create a Log Analytics workspace with PowerShell

This script gets you up and running quickly with an Azure Log Analytics workspace, which is required if you want to start collecting, analyzing, and taking action on data.

This sample requires Azure PowerShell Az 1.0 or later. Run Get-Module -ListAvailable Az to see which versions are installed. If you need to install, see Install Azure PowerShell module.

Run Connect-AzAccount to sign in to Azure.

If you don't have an Azure subscription, create a free account before you begin.

Sample script


This article has been updated to use the Azure Az PowerShell module. The Az PowerShell module is the recommended PowerShell module for interacting with Azure. To get started with the Az PowerShell module, see Install Azure PowerShell. To learn how to migrate to the Az PowerShell module, see Migrate Azure PowerShell from AzureRM to Az.

#Variables for common values
$ResourceGroupName = "ResourceGroup01"
$SubscriptionID = "SubscriptionID"
$WorkspaceName = "DefaultWorkspace-" + (Get-Random -Maximum 99999) + "-" + $ResourceGroupName
$Location = "eastus"

# Stop the script if any errors occur
$ErrorActionPreference = "Stop"

# Connect to the current Azure account
Write-Output "Pulling Azure account credentials..."

# Login to Azure account
$Account = Add-AzAccount

# If a subscriptionID has not been provided, select the first registered to the account
if ([string]::IsNullOrEmpty($SubscriptionID)) {
    # Get a list of all subscriptions
    $Subscription =  Get-AzSubscription

    # Get the subscription ID
    $SubscriptionID = (($Subscription).SubscriptionId | Select -First 1).toString()

    # Get the tenant id for this subscription
    $TenantID = (($Subscription).TenantId | Select -First 1).toString()

} else {

    # Get a reference to the current subscription
    $Subscription = Get-AzSubscription -SubscriptionId $SubscriptionID

    # Get the tenant id for this subscription
    $TenantID = $Subscription.TenantId

# Set the active subscription
$null = Set-AzContext -SubscriptionID $SubscriptionID -Tenant $TenantID

# Check that the resource group is valid
$null = Get-AzResourceGroup -Name $ResourceGroupName
# Create a new Log Analytics workspace if needed
try {

    $Workspace = Get-AzOperationalInsightsWorkspace -Name $WorkspaceName -ResourceGroupName $ResourceGroupName  -ErrorAction Stop
    $ExistingLocation = $Workspace.Location
    Write-Output "Workspace named $WorkspaceName in region $ExistingLocation already exists."
    Write-Output "No further action required, script quitting."

} catch {

    Write-Output "Creating new workspace named $WorkspaceName in region $Location..."
    # Create the new workspace for the given name, region, and resource group
    $Workspace = New-AzOperationalInsightsWorkspace -Location $Location -Name $WorkspaceName -Sku Standard -ResourceGroupName $ResourceGroupName


Script explanation

This script uses following commands to create a new Log Analytics workspace in your subscription. Each command in the table links to command specific documentation.

Command Notes
Get-AzOperationalInsightsWorkspace Gets information about an existing workspace.
New-AzOperationalInsightsWorkspace Creates a workspace in the specified resource group and location.

Next steps

For more information on the Azure PowerShell module, see Azure PowerShell documentation.