Monitoring
CoreLog Analytics workspace
Queryable Azure Monitor log store with retention and access boundaries.
Key points
- A Log Analytics workspace stores Azure Monitor logs for KQL queries, retention, and role-separated access.
- Workspace boundaries affect correlation, tenancy, region, cost, retention, and who can query the data.
Best-known use cases
- Keep recent operational logs searchable while routing a separate copy to an archive when required.
What candidates often confuse it with
- Log Analytics supports interactive log analysis; storage is the archive destination and Event Hubs streams data to external consumers.
Key takeaway
Use a dedicated workspace when searchable telemetry needs a defined query, access, region, or retention boundary.
Relevant exam tasks
- D1.1.S1 — Recommend a logging solution
- D1.1.S2 — Recommend a solution for routing logs