Invoke-AzOperationalInsightsQuery: Operation returned an invalid status code 'NotFound'

Question

Invoke-AzOperationalInsightsQuery: Operation returned an invalid status code 'NotFound'

Germain, Yves 11

I am running a query in the portal which works fine. When I try to reproduce this in PowerShell I get the previous error message.

This is the kusto query:

AuditLogs
| where OperationName == "Update conditional access policy"
| where TimeGenerated > ago(5d)

I have the right workspaceID, same name, and Resourcegroup in the same Subscription.
$workspaceid = get-azoperationalInsightsWorkspace -Name *******-cac-ws-security-01 -ResourceGroupName *******-cac-rg-security-logs-01
$query = 'AuditLogs
| where OperationName == "Update conditional access policy"
| where TimeGenerated > ago(5d)'

C:\temp> Invoke-AzOperationalInsightsQuery -Query $query -WorkspaceId $WorkspaceID
Invoke-AzOperationalInsightsQuery: Operation returned an invalid status code 'NotFound'
Here is the result in the portal

Any idea what I could be doing wrong?

Monalla-MSFT 13,161 Reputation points Moderator

2022-12-29T16:12:12.683+00:00

@Germain, Yves - Just checking in to see if the below answer helped. If this answers your query, do click "Accept as Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

2 answers

Your answer

Monalla-MSFT 13,161 Reputation points Moderator

2022-12-29T16:12:12.683+00:00

@Germain, Yves - Just checking in to see if the below answer helped. If this answers your query, do click "Accept as Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

You have to select the workspace ID ($workspace.CustomerId), not the whole object ($workspace).

$workspace = Get-AzoperationalInsightsWorkspace `
  -Name *******-cac-ws-security-01 `
  -ResourceGroupName *******-cac-rg-security-logs-01

I changed the variable name in your question from "$workspaceid" into "$workspace" without changing what's in it. And assume you've defined $query for the same KQL query.

Then run a very similar command:

 Invoke-AzOperationalInsightsQuery -Query $query -WorkspaceId $workspace.CustomerId

Answer 2

Monalla-MSFT 13,161 Moderator

Hello @Germain, Yves - Welcome to Microsoft Q&A and thanks for reaching out to us.

Please try adding the service principal to Directory readers using this command and see if it helps:

> Add-AzureADDirectoryRoleMember -ObjectId (Get-AzureADDirectoryRole | where-object {$_.DisplayName -eq "Directory Readers"}).Objectid -RefObjectId <object-id>

Hope this helps. and please feel free to reach out if you have any further questions.

------------------------------------------------------------------

If the above response was helpful, please feel free to "Accept as Answer" and "Upvote" the same so it can be beneficial to the community.

VANDEN ELSCHEN Luc 0 Reputation points

2025-12-05T14:19:01.93+00:00

I've exactly the same problem and above suggestion didn't help. Any other proposal to fix it?

Share via

Invoke-AzOperationalInsightsQuery: Operation returned an invalid status code 'NotFound'

2 answers

Your answer