Move a Log Analytics workspace to a different subscription or resource group

In this article, you'll learn the steps to move a Log Analytics workspace to another resource group or subscription in the same region. To move a workspace across regions, see Move a Log Analytics workspace to another region.

Tip

To learn more about how to move Azure resources through the Azure portal, PowerShell, the Azure CLI, or the REST API, see Move resources to a new resource group or subscription.

Prerequisites

  • The subscription or resource group where you want to move your Log Analytics workspace must be located in the same region as the Log Analytics workspace you're moving.
  • The move operation requires that no services can be linked to the workspace. Prior to the move, delete solutions that rely on linked services, including an Azure Automation account. These solutions must be removed before you can unlink your Automation account. Data collection for the solutions will stop and their tables will be removed from the UI, but data remains in workspace for the retention period defined for table. When you add solutions back after the move, ingestion restored and tables become visible with data. Linked services include:
    • Update management
    • Change tracking
    • Start/Stop VMs during off-hours
    • Microsoft Defender for Cloud
  • Connected Log Analytics agents and Azure Monitor Agent remain connected to the workspace after the move with no interruption to ingestion.
  • Alerts should be re-created after the move, since permissions for alerts is based on workspace resource ID, which changes with the move. Alerts created after June 1, 2019, or in workspaces that were upgraded from the legacy Log Analytics Alert API to the scheduledQueryRules API can be exported in templates and deployed after the move. You can check if the scheduledQueryRules API is used for alerts in your workspace. Alternatively, you can configure alerts manually in the target workspace.
  • Update resource paths after a workspace move for Azure or external resources that point to the workspace. For example: Azure Monitor alert rules, Third-party applications, Custom scripting, etc.

Permissions required

Action Permissions required
Verify the Microsoft Entra tenant. Microsoft.AzureActiveDirectory/b2cDirectories/read permissions, as provided by the Log Analytics Reader built-in role, for example.
Delete a solution. Microsoft.OperationsManagement/solutions/delete permissions on the solution, as provided by the Log Analytics Contributor built-in role, for example.
Remove alert rules for the Start/Stop VMs solution. microsoft.insights/scheduledqueryrules/delete permissions, as provided by the Monitoring Contributor built-in role, for example.
Unlink the Automation account Microsoft.OperationalInsights/workspaces/linkedServices/delete permissions on the linked Log Analytics workspace, as provided by the Log Analytics Contributor built-in role, for example.
Move a Log Analytics workspace. Microsoft.OperationalInsights/workspaces/delete and Microsoft.OperationalInsights/workspaces/write permissions on the Log Analytics workspace, as provided by the Log Analytics Contributor built-in role, for example.

Considerations and limits

Consider these points before you move a Log Analytics workspace:

  • It can take Azure Resource Manager a few hours to complete. Solutions might be unresponsive during the operation.
  • Managed solutions that are installed in the workspace, will be moved as well.
  • Managed solutions are workspace's objects and can't be moved independently.
  • Workspace keys (both primary and secondary) are regenerated with a workspace move operation. If you keep a copy of your workspace keys in Azure Key Vault, update them with the new keys generated after the workspace is moved.

Important

Microsoft Sentinel customers

  • Currently, after Microsoft Sentinel is deployed on a workspace, moving the workspace to another resource group or subscription isn't supported.
  • If you've already moved the workspace, disable all active rules under Analytics and reenable them after five minutes. This solution should be effective in most cases, although it's unsupported and undertaken at your own risk.

Verify the Microsoft Entra tenant

The workspace source and destination subscriptions must exist within the same Microsoft tenant. Use Azure PowerShell to verify that both subscriptions have the same Entra tenant ID.

Find your Microsoft Entra tenant for the source and destination subscriptions.

Delete solutions

  1. Open the menu for the resource group where any solutions are installed.
  2. Select the solutions to remove.
  3. Select Delete Resources and then confirm the resources to be removed by selecting Delete. Screenshot that shows deleting solutions.

Remove alert rules for the Start/Stop VMs solution

To remove the Start/Stop VMs solution, you also need to remove the alert rules created by the solution.

  1. Open the Monitor menu and then select Alerts.

  2. Select Manage alert rules.

  3. Select the following three alert rules, and then select Delete:

    • AutoStop_VM_Child
    • ScheduledStartStop_Parent
    • SequencedStartStop_Parent

    Screenshot that shows deleting rules.

See Delete a standalone Automation account linked to workspace.

Move your workspace

  1. Open the Log Analytics workspaces menu and then select your workspace.

  2. On the Overview page, select change next to either Resource group or Subscription name.

  3. A new page opens with a list of resources related to the workspace. Select the resources to move to the same destination subscription and resource group as the workspace.

  4. Select a destination Subscription and Resource group. If you're moving the workspace to another resource group in the same subscription, you won't see the Subscription option.

  5. Select OK to move the workspace and selected resources.

    Screenshot that shows the Overview pane in the Log Analytics workspace with options to change the resource group and subscription name.

Important

After the move operation, removed solutions and the Automation account link should be reconfigured to bring the workspace back to its previous state.

Next steps

For a list of which resources support the move operation, see Move operation support for resources.