You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Move a Log Analytics workspace to a different subscription or resource group
13
13
14
-
In this article, you'll learn the steps to move a Log Analytics workspace to another resource group or subscription in the same region. To learn more about how to move Azure resources through the Azure portal, PowerShell, the Azure CLI, or the REST API, see [Move resources to a new resource group or subscription](../../azure-resource-manager/management/move-resource-group-and-subscription.md).
14
+
In this article, you'll learn the steps to move a Log Analytics workspace to another resource group or subscription in the same region.
15
15
16
-
> [!IMPORTANT]
17
-
> You can't move a workspace to a different region by using this procedure. Follow the steps in the article [Move a Log Analytics workspace to another region](./move-workspace-region.md) to move a workspace across regions.
16
+
> [!TIP]
17
+
> To learn more about how to move Azure resources through the Azure portal, PowerShell, the Azure CLI, or the REST API, see [Move resources to a new resource group or subscription](../../azure-resource-manager/management/move-resource-group-and-subscription.md).
18
18
19
-
## Verify the Azure Active Directory tenant
20
-
The workspace source and destination subscriptions must exist within the same Azure Active Directory tenant. Use Azure PowerShell to verify that both subscriptions have the same tenant ID.
- The subscription or resource group where you want to move your Log Analytics workspace must be located in the same region as the Log Analytics workspace you're moving.
22
+
> [!NOTE]
23
+
> To move a workspace across regions, see [Move a Log Analytics workspace to another region](./move-workspace-region.md).
24
+
- The move operation requires that no services can be linked to the workspace. Prior to the move, delete solutions that rely on linked services, including an Azure Automation account. These solutions must be removed before you can unlink your Automation account. Data collection for the solutions will stop and their tables will be removed from the UI, but data will remain in the workspace per the table retention period. When you add solutions after the move, ingestion is restored and tables become visible with data. Linked services include:
25
+
- Update management
26
+
- Change tracking
27
+
- Start/Stop VMs during off-hours
28
+
- Microsoft Defender for Cloud
29
+
- Connected [Log Analytics agents](../agents/log-analytics-agent.md) and [Azure Monitor Agent](../agents/azure-monitor-agent-overview.md) remain connected to the workspace after the move with no interruption to ingestion.
30
+
- Microsoft Sentinel can't be deployed on the Log Analytics workspace.
31
+
32
+
## Permissions required
33
+
34
+
| Action | Permissions required |
35
+
|:---|:---|
36
+
| Verify the Azure Active Directory tenant. |`Microsoft.AzureActiveDirectory/b2cDirectories/read` permissions, as provided by the [Log Analytics Reader built-in role](./manage-access.md#log-analytics-reader), for example. |
37
+
| Delete a solution. |`Microsoft.OperationsManagement/solutions/delete` permissions on the solution, as provided by the [Log Analytics Contributor built-in role](./manage-access.md#log-analytics-contributor), for example. |
38
+
| Remove alert rules for the Start/Stop VMs solution. |`microsoft.insights/scheduledqueryrules/delete` permissions, as provided by the [Monitoring Contributor built-in role](../../role-based-access-control/built-in-roles.md#monitoring-contributor), for example. |
39
+
| Unlink the Automation account |`Microsoft.OperationalInsights/workspaces/linkedServices/delete` permissions on the linked Log Analytics workspace, as provided by the [Log Analytics Contributor built-in role](./manage-access.md#log-analytics-contributor), for example. |
40
+
| Move a Log Analytics workspace. |`Microsoft.OperationalInsights/workspaces/delete` and `Microsoft.OperationalInsights/workspaces/write` permissions on the Log Analytics workspace, as provided by the [Log Analytics Contributor built-in role](./manage-access.md#log-analytics-contributor), for example. |
26
41
27
42
## Workspace move considerations
28
43
29
44
Consider these points before you move a Log Analytics workspace:
30
45
31
46
- Managed solutions that are installed in the workspace will be moved in this operation.
32
-
- The move operation requires that no services can be linked to the workspace. Solutions that rely on linked services must be removed prior to the move, including an Azure Automation account. These solutions must be removed before you can unlink your Automation account. Data collection for the solutions will stop and their tables will be removed from the UI, but data will remain in the workspace per the table retention period. When you add solutions after the move, ingestion is restored and tables become visible with data. Linked services include:
33
-
- Update management
34
-
- Change tracking
35
-
- Start/Stop VMs during off-hours
36
-
- Microsoft Defender for Cloud
37
47
- Workspace keys (both primary and secondary) are regenerated with a workspace move operation. If you keep a copy of your workspace keys in Azure Key Vault, update them with the new keys generated after the workspace is moved.
38
-
- Connected [Log Analytics agents](../agents/log-analytics-agent.md) and [Azure Monitor Agent](../agents/azure-monitor-agent-overview.md) remain connected to the workspace after the move with no interruption to ingestion.
39
48
40
49
>[!IMPORTANT]
41
50
> **Microsoft Sentinel customers**
@@ -53,27 +62,84 @@ Consider these points before you move a Log Analytics workspace:
53
62
> - Custom scripting
54
63
>
55
64
56
-
### Delete solutions in the Azure portal
57
-
Use the following procedure to remove solutions by using the Azure portal:
65
+
## Verify the Azure Active Directory tenant
66
+
The workspace source and destination subscriptions must exist within the same Azure Active Directory tenant. Use Azure PowerShell to verify that both subscriptions have the same tenant ID.
67
+
68
+
### [Portal](#tab/azure-portal)
69
+
70
+
[Find your Azure AD tenant](../../azure-portal/get-subscription-tenant-id.md#find-your-azure-ad-tenant) for the source and destination subscriptions.
71
+
72
+
### [REST API](#tab/rest-api)
73
+
74
+
To fetch the tenant ID for the source and destination subscriptions, call the [Subscriptions - Get API](/rest/api/resources/subscriptions/get):
75
+
76
+
```http
77
+
GET https://management.azure.com/subscriptions/{subscriptionId}?api-version=2020-01-01
78
+
```
79
+
80
+
### [CLI](#tab/cli)
81
+
82
+
Run the [az account tenant](/cli/azure/account/tenant) command:
83
+
84
+
```azurecli
85
+
az account tenant list --subscription <your-source-subscription>
86
+
az account tenant list --subscription <your-destination-subscription>
87
+
```
88
+
89
+
### [PowerShell](#tab/PowerShell)
90
+
91
+
Run the [Get-AzSubscription](/powershell/module/az.accounts/get-azsubscription/) command:
To remove solutions, run the [az resource delete](/cli/azure/resource#az-resource-delete) command. You need to specify the name of the resource, resource type, and resource group for the solution you want to delete:
66
121
67
-
To remove solutions by using PowerShell, use the [Remove-AzResource](/powershell/module/az.resources/remove-azresource) cmdlet as shown in the following example:
122
+
```azurecli
123
+
az resource delete --name <resource-name> --resource-type <resource-type> --resource-group <resource-group-name>
124
+
```
125
+
126
+
### [PowerShell](#tab/PowerShell)
127
+
128
+
To remove solutions, use the [Remove-AzResource](/powershell/module/az.resources/remove-azresource) cmdlet as shown in the following example:
### Remove alert rules for the Start/Stop VMs solution
76
-
To remove the **Start/Stop VMs** solution, you also need to remove the alert rules created by the solution. Use the following procedure in the Azure portal to remove these rules:
139
+
140
+
To remove the **Start/Stop VMs** solution, you also need to remove the alert rules created by the solution.
141
+
142
+
### [Portal](#tab/azure-portal)
77
143
78
144
1. Open the **Monitor** menu and then select **Alerts**.
79
145
1. Select **Manage alert rules**.
@@ -85,21 +151,71 @@ To remove the **Start/Stop VMs** solution, you also need to remove the alert rul
85
151
86
152
[](media/move-workspace/delete-rules.png#lightbox)
87
153
154
+
### [REST API](#tab/rest-api)
155
+
156
+
Delete the following alert rules by calling the Scheduled Query Rules - Delete API:
Delete the following alert rules by running the [az monitor scheduled-query delete](/cli/azure/monitor/scheduled-query#az-monitor-scheduled-query-delete) command:
169
+
170
+
- AutoStop_VM_Child
171
+
- ScheduledStartStop_Parent
172
+
- SequencedStartStop_Parent
173
+
174
+
```azurecli
175
+
az monitor scheduled-query delete [--ids]
176
+
[--name]
177
+
[--resource-group]
178
+
[--subscription]
179
+
[--yes]
180
+
```
181
+
182
+
### [PowerShell](#tab/PowerShell)
183
+
184
+
Delete the following alert rules by running the [Remove-AzScheduledQueryRule](/powershell/module/az.monitor/remove-azscheduledqueryrule) command:
185
+
186
+
- AutoStop_VM_Child
187
+
- ScheduledStartStop_Parent
188
+
- SequencedStartStop_Parent
189
+
190
+
---
191
+
88
192
## Unlink the Automation account
89
-
Use the following procedure to unlink the Automation account from the workspace by using the Azure portal:
90
193
91
-
1. Open the **Automation accounts** menu and then select the account to remove.
92
-
1. On the **Related Resources** section of the menu, select **Linked workspace**.
93
-
1. Select **Unlink workspace** to unlink the workspace from your Automation account.
194
+
### [Portal](#tab/azure-portal)
94
195
95
-
[](media/move-workspace/unlink-workspace.png#lightbox)
196
+
See [Delete a standalone Automation account linked to workspace](../../automation/delete-account.md#delete-a-standalone-automation-account-linked-to-workspace).
96
197
97
-
## Move your workspace
198
+
### [ REST API](#tab/rest-api)
199
+
200
+
Call the [Linked Services - Delete API](/rest/api/loganalytics/linked-services/delete).
Move your workspace by using the Azure portal or PowerShell.
208
+
Not supported.
209
+
210
+
### [PowerShell](#tab/PowerShell)
211
+
212
+
Not supported.
213
+
214
+
---
215
+
216
+
## Move your workspace
100
217
101
-
### Azure portal
102
-
Use the following procedure to move your workspace by using the Azure portal:
218
+
### [Portal](#tab/azure-portal)
103
219
104
220
1. Open the **Log Analytics workspaces** menu and then select your workspace.
105
221
1. On the **Overview** page, select **change** next to either **Resource group** or **Subscription name**.
@@ -109,13 +225,34 @@ Use the following procedure to move your workspace by using the Azure portal:
109
225
110
226
[](media/move-workspace/portal.png#lightbox)
111
227
112
-
### PowerShell
113
-
To move your workspace by using PowerShell, use the [Move-AzResource](/powershell/module/AzureRM.Resources/Move-AzureRmResource) cmdlet as shown in the following example:
228
+
### [ REST API](#tab/rest-api)
229
+
230
+
To move your workspace, call the [Resources - Move Resources API](/rest/api/resources/resources/move-resources).
231
+
232
+
```http
233
+
POST https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{sourceResourceGroupName}/moveResources?api-version=2021-04-01
234
+
```
235
+
236
+
### [CLI](#tab/cli)
237
+
238
+
To move your workspace, run the [az resource move](/cli/azure/resource#az-resource-move) command:
239
+
240
+
```azurecli
241
+
az resource move --destination-group
242
+
--ids
243
+
[--destination-subscription-id]
244
+
```
245
+
246
+
### [PowerShell](#tab/PowerShell)
247
+
248
+
To move your workspace, run the [Move-AzResource](/powershell/module/AzureRM.Resources/Move-AzureRmResource) cmdlet as shown in the following example:
> After the move operation, removed solutions and the Automation account link should be reconfigured to bring the workspace back to its previous state.
0 commit comments