Log Analytics Workspace Design
Single vs multiple workspaces · Access modes · Table plans · Retention
Practice questions for this topic →
When to create another workspace
| Criterion | Effect |
|---|---|
| Default | Start with ONE workspace; use the fewest that meet requirements; data volume doesn't limit performance |
| Data residency / region | A workspace lives in one region, so residency rules may force more |
| Multiple Entra tenants | Several data sources can send only to a workspace in the same tenant, so usually one per tenant |
| Security team separation | Optional dedicated Sentinel workspace |
| Cost | Consolidation can unlock commitment tiers; per-region workspaces can cut egress |
Access control
| Mode | What you see |
|---|---|
| Workspace-context | All tables you have permission for in the workspace (Logs opened from the workspace) |
| Resource-context | Only logs for resources you can access (Logs opened from a resource), no workspace role needed |
| Table-level RBAC | Restrict specific tables |
Table plans and retention
| Plan | Use for | Query | Alerts |
|---|---|---|---|
| Analytics | Continuous monitoring, latency-sensitive | Full KQL; analytics retention up to 2 years | Yes |
| Basic | Troubleshooting, incident response | Fixed 30 days; older data via search jobs | Limited |
| Auxiliary / Lake | High-volume verbose data, cheapest | Queryable for the whole retention period | No |
- Default retention is 30 days (some tables 90). Total retention can reach 12 years; analytics retention up to 2 years. 31 days of analytics retention are included in the ingestion price, so going lower saves nothing.
- Shortening a table's total retention waits 30 days before removing data, so you can revert.
- A table's plan can be switched once per week; setting it needs workspace write and table write permissions (Log Analytics Contributor). Moving Analytics → Auxiliary stops alerts for that table.
- All DCR-based custom tables support all plans; Azure table support for Basic and Auxiliary varies by table.
Exam Tips
Tick each tip once you can answer it without looking.
“Default design for a new monitoring solution” → One Log Analytics workspace. Trap: Don't create one per app or team without a requirement.
“EU logs must stay in the EU; US logs in the US” → One workspace per required region.
“App owners may only see logs for their own resources, minimal admin” → Resource-context access (permissions on the resources).
“Hide security tables from operations staff in a shared workspace” → Table-level RBAC.
“Keep audit logs 7 years at lowest cost, rarely queried” → Long-term (total) retention up to 12 years, or archive to Storage. Trap: Analytics retention max is 2 years.
“Huge volume of verbose logs, cheapest ingest, no alerts needed” → Auxiliary / Lake table plan.
“Debug logs, queried occasionally during incidents” → Basic table plan. Trap: Basic queries only cover 30 days.
“Large predictable daily ingestion, reduce cost” → Commitment tier (consolidate into fewer workspaces).
“MSP must query workspaces in many customer tenants” → Azure Lighthouse (cross-tenant queries).
“Switch a table's plan repeatedly” → Limited to one plan switch per table per week. Trap: Setting a plan needs workspace write and table write permissions (Log Analytics Contributor).
“Shorten a table's total retention by mistake” → Data is removed only after a 30-day wait, so you can revert. Trap: Total retention can reach 12 years.
“Lower analytics retention below 31 days to save money” → No saving: 31 days are included in the ingestion price. Trap: It can go as low as 4 days through the API or CLI.
“Move a table from Analytics to Auxiliary” → Alerts stop working for that table; queries and summary rules change. Trap: Basic queries cover only 30 days.