Workspaces - List

Service:: Log Analytics

API Version:: 2025-07-01

Gets the workspaces in a subscription.

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.OperationalInsights/workspaces?api-version=2025-07-01

URI Parameters

Name	In	Required	Type	Description
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Responses

Name	Type	Description
200 OK	WorkspaceListResult	Azure operation completed successfully.
Other Status Codes	ErrorResponse	An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

WorkspacesSubscriptionList

Sample request

HTTP

GET https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.OperationalInsights/workspaces?api-version=2025-07-01

Sample response

Status code:: 200

{
  "value": [
    {
      "name": "AzTest2170",
      "type": "Microsoft.OperationalInsights/workspaces",
      "id": "/subscriptions/00000000-0000-0000-0000-000000000005/resourcegroups/oiautorest6685/providers/microsoft.operationalinsights/workspaces/aztest2170",
      "location": "australiasoutheast",
      "properties": {
        "customerId": "bc089d7b-485c-4aff-a71e-c00f362d8d2f",
        "provisioningState": "Succeeded",
        "publicNetworkAccessForIngestion": "Enabled",
        "publicNetworkAccessForQuery": "Enabled",
        "retentionInDays": 30,
        "sku": {
          "name": "PerGB2018"
        }
      },
      "tags": {
        "tag1": "val1"
      }
    }
  ]
}

Definitions

Name	Description
createdByType	The type of identity that created the resource.
DataIngestionStatus	The status of data ingestion for this workspace.
ErrorAdditionalInfo	The resource management error additional info.
ErrorDetail	The error detail.
ErrorResponse	Error response
Identity	Identity for the resource.
IdentityType	Type of managed service identity.
PrivateLinkScopedResource	The private link scope resource reference.
PublicNetworkAccessType	The network access type for accessing Log Analytics ingestion.
systemData	Metadata pertaining to creation and last modification of the resource.
UserIdentityProperties	User assigned identity properties.
Workspace	The top level Workspace resource container.
WorkspaceCapping	The daily volume cap for ingestion.
WorkspaceEntityStatus	The provisioning state of the workspace.
WorkspaceFailoverProperties	The failover state of the replication.
WorkspaceFailoverState	The failover state of the replication.
WorkspaceFeatures	Workspace features.
WorkspaceListResult	The list workspaces operation response.
WorkspaceReplicationProperties	Workspace replication properties.
WorkspaceReplicationState	The provisioning state of the replication.
WorkspaceSku	The SKU (tier) of a workspace.
WorkspaceSkuNameEnum	The name of the SKU.

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

DataIngestionStatus

Enumeration

The status of data ingestion for this workspace.

Value	Description
RespectQuota	Ingestion enabled following daily cap quota reset, or subscription enablement.
ForceOn	Ingestion started following service setting change.
ForceOff	Ingestion stopped following service setting change.
OverQuota	Reached daily cap quota, ingestion stopped.
SubscriptionSuspended	Ingestion stopped following suspended subscription.
ApproachingQuota	80% of daily cap quota reached.

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorDetail

Object

The error detail.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorDetail[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorResponse

Object

Error response

Name	Type	Description
error	ErrorDetail	The error object.

Identity

Object

Identity for the resource.

Name	Type	Description
principalId	string	The principal ID of resource identity.
tenantId	string	The tenant ID of resource.
type	IdentityType	Type of managed service identity.
userAssignedIdentities	<string, UserIdentityProperties>	The list of user identities associated with the resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'.

IdentityType

Enumeration

Type of managed service identity.

Value	Description
SystemAssigned	SystemAssigned
UserAssigned	UserAssigned
None	None

PrivateLinkScopedResource

Object

The private link scope resource reference.

Name	Type	Description
resourceId	string	The full resource Id of the private link scope resource.
scopeId	string	The private link scope unique Identifier.

PublicNetworkAccessType

Enumeration

The network access type for accessing Log Analytics ingestion.

Value	Description
Enabled	Enables connectivity to Log Analytics through public DNS.
Disabled	Disables public connectivity to Log Analytics through public DNS.
SecuredByPerimeter	Resource is only accessible from private networks and access approved by network security perimeter associated to this resource.

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

UserIdentityProperties

Object

User assigned identity properties.

Name	Type	Description
clientId	string	The client id of user assigned identity.
principalId	string	The principal id of user assigned identity.

Workspace

Object

The top level Workspace resource container.

Name	Type	Default value	Description
etag	string		The etag of the workspace.
id	string (arm-id)		Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
identity	Identity		The identity of the resource.
location	string		The geo-location where the resource lives
name	string		The name of the resource
properties.createdDate	string (date-time)		Workspace creation date.
properties.customerId	string		This is a read-only property. Represents the ID associated with the workspace.
properties.defaultDataCollectionRuleResourceId	string		The resource ID of the default Data Collection Rule to use for this workspace. Expected format is - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}.
properties.failover	WorkspaceFailoverProperties		workspace failover properties.
properties.features	WorkspaceFeatures		Workspace features.
properties.forceCmkForQuery	boolean		Indicates whether customer managed storage is mandatory for query management.
properties.modifiedDate	string (date-time)		Workspace modification date.
properties.privateLinkScopedResources	PrivateLinkScopedResource[]		List of linked private link scope resources.
properties.provisioningState	WorkspaceEntityStatus		The provisioning state of the workspace.
properties.publicNetworkAccessForIngestion	PublicNetworkAccessType	Enabled	The network access type for accessing Log Analytics ingestion.
properties.publicNetworkAccessForQuery	PublicNetworkAccessType	Enabled	The network access type for accessing Log Analytics query.
properties.replication	WorkspaceReplicationProperties		workspace replication properties.
properties.retentionInDays	integer (int32)		The workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details.
properties.sku	WorkspaceSku		The SKU of the workspace.
properties.workspaceCapping	WorkspaceCapping		The daily volume cap for ingestion.
systemData	systemData		Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object		Resource tags.
type	string		The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

WorkspaceCapping

Object

The daily volume cap for ingestion.

Name	Type	Description
dailyQuotaGb	number (double)	The workspace daily quota for ingestion.
dataIngestionStatus	DataIngestionStatus	The status of data ingestion for this workspace.
quotaNextResetTime	string	The time when the quota will be rest.

WorkspaceEntityStatus

Enumeration

The provisioning state of the workspace.

Value	Description
Creating	Creating
Succeeded	Succeeded
Failed	Failed
Canceled	Canceled
Deleting	Deleting
ProvisioningAccount	ProvisioningAccount
Updating	Updating

WorkspaceFailoverProperties

Object

The failover state of the replication.

Name	Type	Description
lastModifiedDate	string (date-time)	The last time when the failover state was updated.
state	WorkspaceFailoverState	The failover state of the replication.

WorkspaceFailoverState

Enumeration

The failover state of the replication.

Value	Description
Inactive	Inactive
Activating	Activating
Active	Active
Deactivating	Deactivating
Failed	Failed

WorkspaceFeatures

Object

Workspace features.

Name	Type	Description
associations	string[]	List of associations for the workspace. Indicates if the workspace is associated with any of the following experiences: MDC, Sentinel, SentinelGraph, etc.
clusterResourceId	string	Dedicated LA cluster resourceId that is linked to the workspaces.
disableLocalAuth	boolean	Disable Non-AAD based Auth.
enableDataExport	boolean	Flag that indicate if data should be exported.
enableLogAccessUsingOnlyResourcePermissions	boolean	Flag that indicate which permission to use - resource or workspace or both.
immediatePurgeDataOn30Days	boolean	Flag that describes if we want to remove the data after 30 days.
unifiedSentinelBillingOnly	boolean	An indication if the specify workspace is limited to sentinel's unified billing model only.

WorkspaceListResult

Object

The list workspaces operation response.

Name	Type	Description
nextLink	string	The URL to get the next set of results.
value	Workspace[]	A list of workspaces.

WorkspaceReplicationProperties

Object

Workspace replication properties.

Name	Type	Description
createdDate	string (date-time)	The last time when the replication was enabled.
enabled	boolean	Specifies whether the replication is enabled or not. When true, workspace configuration and data is replicated to the specified location. If replication is been enabled, location must be provided.
lastModifiedDate	string (date-time)	The last time when the replication was updated.
location	string	The location of the replication.
provisioningState	WorkspaceReplicationState	The provisioning state of the replication.

WorkspaceReplicationState

Enumeration

The provisioning state of the replication.

Value	Description
Succeeded	Succeeded
EnableRequested	EnableRequested
Enabling	Enabling
DisableRequested	DisableRequested
Disabling	Disabling
RollbackRequested	RollbackRequested
RollingBack	RollingBack
Failed	Failed
Canceled	Canceled

WorkspaceSku

Object

The SKU (tier) of a workspace.

Name	Type	Description
capacityReservationLevel	integer (int32)	The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.
lastSkuUpdate	string (date-time)	The last time when the sku was updated.
name	WorkspaceSkuNameEnum	The name of the SKU.

WorkspaceSkuNameEnum

Enumeration

The name of the SKU.

Value	Description
Free	Free
Standard	Standard
Premium	Premium
PerNode	PerNode
PerGB2018	PerGB2018
Standalone	Standalone
CapacityReservation	CapacityReservation
LACluster	LACluster