Logs are not being sent to my Azure Log Analytics workspace

Hi @BCAzure01

Thank you for posting your question on Microsoft Q&A. Here are some troubleshooting steps that may help address your issue. 

• The diagnostic settings resource (/providers/microsoft.aadiam/diagnosticSettings) is not fully linked to the subscription in certain tenant/subscription combinations.
• Azure’s cleanup process removes these “orphaned” resources automatically.

Resolution Steps

• Verify Resource Consistency
  • Run:

Shell

az provider show --namespace Microsoft.AADIAM

az provider show --namespace Microsoft.Insights

Ensure both providers are Registered (you already confirmed this).

• Use Subscription-Level Diagnostic Settings
  • Instead of creating diagnostic settings directly under Microsoft Entra ID, configure them at the subscription level using:

        - Azure Monitor → Diagnostic Settings → Subscription
        
        
              - This ensures the resource is tied to subscription and avoids orphaning.
        
              
              - Apply via ARM Template or Bicep
        
              
                 - Deploy the diagnostic settings using an ARM template or Bicep script. This creates a strong resource association:
        ````JSON`
    
    

{

"type": "Microsoft.AADIAM/diagnosticSettings",

"name": "<setting-name>",

"properties": {

"workspaceId": "<LogAnalytics-Workspace-Resource-ID>",

"logs": [

{

"category": "AuditLogs",

"enabled": true

}

]

}

}

• Deploy with:

Shell

az deployment sub create --template-file diagnostic.json

• Check for Known Bug & Apply Fix
  • Microsoft acknowledged this as a backend bug. The workaround is:

        - Ensure the diagnostic setting is created with a valid subscription scope.
        
        
              - If still removed, open a support ticket referencing the known issue: _“DiagnosticSettings orphaned resource cleanup for Microsoft.AADIAM”_.
        
              
              - Alternative: Use Event Hub or Storage
        
              
                 - If Log Analytics keeps failing, route logs to Event Hub or Storage Account temporarily until Microsoft fully resolves the bug.
        ```Best Practice
    
    

• Always deploy diagnostic settings via ARM/Bicep or Terraform for persistence.
• Avoid creating them manually in the portal for Entra ID until Microsoft confirms the fix.

References -

• Enable logging with Azure Monitor
• Set up diagnostic logging
• Troubleshoot why data is no longer being collected in Azure Monitor
• Using Diagnostic settings to export to Log Analytics
• Troubleshoot Missing or Delayed Logs in Azure Log Analytics Workspace
• Monitor Azure Analysis Services

Thanks,
Vrishabh

Hi @BCAzure01

We haven't heard back from you. Please reply if you have any questions in this matter and we will gladly continue the discussion.

Thanks,
Vrishabh

Thank you for your reply.

Regarding the workaround of checking for known bugs and applying fixes,

we have received the answer below,

but could you please tell us the specific detailed steps, from preparation to execution and how to obtain it?

Please tell us step by step what tools to use and what commands to enter and execute.

＝＝＝＝＝＝＝＝＝

• Ensure the diagnostic setting is created with a valid subscription scope.

      - If still removed, open a support ticket referencing the known issue: _“DiagnosticSettings orphaned resource cleanup for Microsoft.AADIAM”_.
  
  
  
  
  
      - Alternative: Use Event Hub or Storage
  
  
  
  
  
         - If Log Analytics keeps failing, route logs to Event Hub or Storage Account temporarily until Microsoft fully resolves the bug.
  

＝＝＝＝＝＝＝＝＝

Hi BCAzure01,

We haven't heard back from you. Please reply if you have any questions in this matter and we will gladly continue the discussion.

Thanks,
Vrishabh