Move a Log Analytics workspace to different subscription or resource group
In this article, you'll learn the steps to move Log Analytics workspace to another resource group or subscription in the same region. You can learn more about moving Azure resources through the Azure portal, PowerShell, the Azure CLI, or the REST API. at Move resources to a new resource group or subscription.
You can't move a workspace to a different region.
Verify Active Directory tenant
The workspace source and destination subscriptions must exist within the same Azure Active Directory tenant. Use Azure PowerShell to verify that both subscriptions have the same tenant ID.
(Get-AzSubscription -SubscriptionName <your-source-subscription>).TenantId (Get-AzSubscription -SubscriptionName <your-destination-subscription>).TenantId
Workspace move considerations
- Managed solutions that are installed in the workspace will be moved with the Log Analytics workspace move operation.
- Workspace keys (both primary and secondary) are re-generated with workspace move operation. If you keep a copy of your workspace keys in key vault, update them with the new keys generated after the workspace move.
- Connected agents will remain connected and keep send data to the workspace after the move.
- Since the move operation requires that there are no Linked Services from the workspace, solutions that rely on that link must be removed to allow the workspace move. Solutions that must be removed before you can unlink your automation account:
- Update Management
- Change Tracking
- Start/Stop VMs during off-hours
- Azure Security Center
Azure Sentinel customers
- Currently, after Azure Sentinel is deployed on a workspace, moving the workspace to another resource group or subscription isn't supported.
- If you have already moved the workspace, disable all active rules under Analytics and re-enable them after five minutes. This should be an effective solution in most cases, though, to reiterate, it is unsupported and undertaken at your own risk.
- All alerts must be re-created after a move because the permissions are based on the Azure Resource ID of the workspace, which changes during a workspace move.
Update resource paths
After a workspace move, any Azure or external resources that point to the workspace must be reviewed and updated to point to the new resource target path.
- Azure Monitor alert rules
- Third-party applications
- Custom scripting
Delete solutions in Azure portal
Use the following procedure to remove the solutions using the Azure portal:
- Open the menu for the resource group that any solutions are installed in.
- Select the solutions to remove.
- Click Delete Resources and then confirm the resources to be removed by clicking Delete.
Delete using PowerShell
To remove the solutions using PowerShell, use the Remove-AzResource cmdlet as shown in the following example:
Remove-AzResource -ResourceType 'Microsoft.OperationsManagement/solutions' -ResourceName "ChangeTracking(<workspace-name>)" -ResourceGroupName <resource-group-name> Remove-AzResource -ResourceType 'Microsoft.OperationsManagement/solutions' -ResourceName "Updates(<workspace-name>)" -ResourceGroupName <resource-group-name> Remove-AzResource -ResourceType 'Microsoft.OperationsManagement/solutions' -ResourceName "Start-Stop-VM(<workspace-name>)" -ResourceGroupName <resource-group-name>
Remove alert rules for Start/Stop VMs solution
To remove Start/Stop VMs solution, you also need to remove the alert rules created by the solution. Use the following procedure in the Azure portal to remove these rules.
Open the Monitor menu and then select Alerts.
Click Manage alert rules.
Select the following three alert rules, and then click Delete.
Unlink Automation account
Use the following procedure to unlink the Automation account from the workspace using the Azure portal:
Open the Automation accounts menu and then select the account to remove.
In the Related Resources section of the menu, select Linked workspace.
Click Unlink workspace to unlink the workspace from your Automation account.
Move your workspace
Use the following procedure to move your workspace using the Azure portal:
Open the Log Analytics workspaces menu and then select your workspace.
In the Overview page, click change next to either Resource group or Subscription.
A new page opens with a list of resources related to the workspace. Select the resources to move to the same destination subscription and resource group as the workspace.
Select a destination Subscription and Resource group. If you're moving the workspace to another resource group in the same subscription, you won't see the Subscription option.
Click OK to move the workspace and selected resources.
To move your workspace using PowerShell, use the Move-AzResource as in the following example:
Move-AzResource -ResourceId "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyResourceGroup01/providers/Microsoft.OperationalInsights/workspaces/MyWorkspace" -DestinationSubscriptionId "00000000-0000-0000-0000-000000000000" -DestinationResourceGroupName "MyResourceGroup02"
After the move operation, removed solutions and Automation account link should be reconfigured to bring the workspace back to its previous state.
- For a list of which resources support move, see Move operation support for resources.