Merge pull request #208957 from guywi-ms/activity-log-collection-delete

Remove legacy collection of activity logs

Author: Maggiemouse1

articles/azure-monitor/essentials/activity-log.md

@@ -1,12 +1,12 @@
 ---
 title: Azure activity log
 description: View the Azure Monitor activity log and send it to Azure Monitor Logs, Azure Event Hubs, and Azure Storage.
-author: bwren
+author: guywi-ms
 services: azure-monitor
 ms.topic: conceptual
 ms.date: 07/01/2022
-ms.author: bwren
-ms.reviewer: lualderm
+ms.author: guywild
+ms.reviewer: orens
 ---
 
 # Azure Monitor activity log
@@ -182,9 +182,24 @@ Each event is stored in the PT1H.json file with the following format. This forma
 
 ## Legacy collection methods
 
+If you're collecting activity logs using the legacy collection method, we recommend you [export activity logs to your Log Analytics workspace](#send-to-log-analytics-workspace) and disable the legacy collection using the [Data Sources - Delete API](/rest/api/loganalytics/data-sources/delete?tabs=HTTP) as follows:
+
+1. List all data sources connected to the workspace using the [Data Sources - List By Workspace API](/rest/api/loganalytics/data-sources/list-by-workspace?tabs=HTTP#code-try-0) and filter for activity logs by setting `filter=kind='AzureActivityLog'`.
+
+    :::image type="content" source="media/activity-log/data-sources-list-by-workspace-api.png" alt-text="Screenshot showing the configuration of the Data Sources - List By Workspace API." lightbox="media/activity-log/data-sources-list-by-workspace-api.png":::    
+
+1. Copy the name of the connection you want to disable from the API response.
+
+    :::image type="content" source="media/activity-log/data-sources-list-by-workspace-api-connection.png" alt-text="Screenshot showing the connection information you need to copy from the output of the Data Sources - List By Workspace API." lightbox="media/activity-log/data-sources-list-by-workspace-api-connection.png":::    
+ 
+1. Use the [Data Sources - Delete API](/rest/api/loganalytics/data-sources/delete?tabs=HTTP) to stop collecting activity logs for the specific resource.
+
+    :::image type="content" source="media/activity-log/data-sources-delete-api.png" alt-text="Screenshot of the configuration of the Data Sources - Delete API." lightbox="media/activity-log/data-sources-delete-api.png":::
+### Managing legacy log profiles
+
 Log profiles are the legacy method for sending the activity log to storage or event hubs. If you're using this method, consider transitioning to diagnostic settings, which provide better functionality and consistency with resource logs.
 
-### [PowerShell](#tab/powershell)
+#### [PowerShell](#tab/powershell)
 
 If a log profile already exists, you first must remove the existing log profile and then create a new one.
 
@@ -234,7 +249,7 @@ This sample PowerShell script creates a log profile that writes the activity log
    Add-AzLogProfile -Name $logProfileName -Location $locations -StorageAccountId  $storageAccountId -ServiceBusRuleId $serviceBusRuleId
    ```
 
-### [CLI](#tab/cli)
+#### [CLI](#tab/cli)
 
 If a log profile already exists, you first must remove the existing log profile and then create a log profile.