Insufficient permissions when I click on Log Analytics or Workbooks

Ludwig Wurmannstätter 0

I'm in the Entra Admin Center under Monitoring & health and click on Workbooks I get an error saying "Insufficient permissions" and then showing me this (Subscription-ID cc01... is changed, this is not the one that is shown in the real error):

"In order for you to be able to leverage Log Analytics or Workbooks you first need to get permission for one of the following workspaces: /subscriptions/cc01cae4-1e4d-16a5-b331-1076320570b1/resourcegroups/aip-log-analytics-rg/providers/microsoft.operationalinsights/workspaces/aip-log-analytics-instance, /subscriptions/cc01cae4-1e4d-16a5-b331-1076320570b1/resourcegroups/ca-log-analytics-instance_rg/providers/microsoft.operationalinsights/workspaces/ca-log-analytics-instance"

I don't have that Subscription in my Tenant, nor in other Tenants I own for testing purposes, nor can I find the shown Ressource groups.

As all that is testing playground, I can't say for sure that the one or the other Subscription was used and is now deleted. But checking with the PS cmd Get-AzSubscription -TenantId here-comes-my-tenant-id it only shows one Subscription and not the one mentioned above in the error.

I even created a new Log Analytics Workspace with a new Workbook connected, but the error stays.

What else can I do to get Entra Monitoring up and running?

Greetings, Ludwig

Pranay Reddy Madireddy 625 Reputation points Microsoft Vendor

2024-11-13T10:44:03.6133333+00:00

Hi Ludwig Wurmannstätter

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

check your account has the right permissions. You need the "Reports Reader" role to see monitoring features in Entra. If you don’t have it, ask your administrator for help.

Make sure you're logged into the right Azure tenant where your subscriptions are. You can run the PowerShell command:

Get-AzSubscription -TenantId <your-tenant-id> to see all subscriptions in your tenant.

If you created a new Log Analytics workspace and still see the error, check that it is properly configured and that your account has the necessary access.

Go to the Azure portal and open the Log Analytics workspaces section. Verify if your user has been assigned any roles related to these workspaces.

If you think the resources were used before but might have been deleted, check the Azure Activity log for any deletion events that show changes to the resources.

If nothing else works, contact Microsoft support for help with permissions and workspace access issues.

For reference, please review this documentation: -
https://zcusa.951200.xyz/en-us/entra/identity/hybrid/connect/how-to-connect-health-data-freshness
https://zcusa.951200.xyz/fr-fr/troubleshoot/entra/entra-id/user-prov-sync/outdate-information-displays
https://zcusa.951200.xyz/en-us/entra/identity/monitoring-health/howto-use-health-scenario-alerts

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Ludwig Wurmannstätter 0 Reputation points

2024-11-13T14:45:37.4766667+00:00

Hi Pranay Reddy,

first of all I'm the Global Admin and I have the Reports reader role. As I mentioned in my Question, the Problem is the Error message mentions a unknown Subscription.
The Get-AzSubscription command shows only one Subscription in this Tenant, and it's not the number shown in the message.

Any other hints?

Ludwig
Pranay Reddy Madireddy 625 Reputation points Microsoft Vendor

2024-11-13T16:41:59+00:00

Hi Ludwig Wurmannstätter

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

Even as a Global Admin with the Reports Reader role, make sure you have the right permissions for the Log Analytics workspaces listed in the error. You need either the Log Analytics Reader or Log Analytics Contributor role for those workspaces.

You can use PowerShell commands to view all Log Analytics workspaces linked to your subscription:

Get-AzOperationalInsightsWorkspace -ResourceGroupName <YourResourceGroupName>

Replace <YourResourceGroupName> with the name of your resource group. This will check if the workspaces mentioned in the error exist or if there are any issues.

If the Get-AzSubscription command shows only one subscription, make sure you're logged into the correct Azure tenant where your subscriptions are. You can switch tenants using:

Connect-AzAccount -TenantId <YourTenantId>

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Ludwig Wurmannstätter 0 Reputation points

2024-11-13T20:38:42.9133333+00:00

Hi @Pranay Reddy Madireddy ,

I know of 5 Tenants where I'm an admin.
I logged in to every single Tenant with my tenant admin as well as the admin@MyDomainName.onmicrosoft.com Account and double checked the Subscriptions. I was unable to see the subscription mentioned in the Error.

Let's assume this is an Subscription I previously had in my Tenant and I deleted it. Is there a way to see and maybe reactivate it? The deletion could be old, maybe 2 or more years :-|
Ludwig Wurmannstätter 0 Reputation points

2024-11-13T21:04:16.05+00:00

Hi @Pranay Reddy Madireddy ,

I think I found a possible explanation --> still doesn't solve the problem.

When I worked for Microsoft this Tenant had e.g., Office 365 IUR (Internal Use Rights) Licenses on it. When I left the company, these Licenses where removed and so where the Subscriptions with all the Content within the Subscription (all Resource groups, Workspaces. ...).

When I now click on Log Analytics in Entra, it seems there is an "old connection".
So the Question now is "how can I reset Entra in a way to start from scratch?"
Ludwig Wurmannstätter 0 Reputation points

2024-11-13T21:25:49.5833333+00:00

deleted
Pranay Reddy Madireddy 625 Reputation points Microsoft Vendor

2024-11-14T18:27:40.82+00:00

Hi Ludwig Wurmannstätter
Once the workspace is deleted, you can create a new one by clicking the "Add" button in the toolbar at the top of the page. When creating a new Log Analytics workspace, ensure that you select the correct subscription and resource group. After the new workspace is created, you can begin using it to collect and analyze data.

thanks
Pranay
Ludwig Wurmannstätter 0 Reputation points

2024-11-15T07:51:44.62+00:00

but how can I delete a Workspace from a Subscription I'm no longer have or even see in my Tenant? Do you know of an PowerShell or GraphAPI command I can use?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Pranay Reddy Madireddy 625 Reputation points Microsoft Vendor

2024-11-15T21:15:19.4333333+00:00

Hi Ludwig Wurmannstätter
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!
Ludwig Wurmannstätter 0 Reputation points

2024-11-15T22:24:23.04+00:00

Hi @Pranay Reddy Madireddy ,

I have no idea why my last post was deleted, except I had two images / results from PowerShell in it.
I'll try to answer in words and not with screenshots.
Your answer with the PS commands have been really helpful, both of them just gave me an error saying I can't set the context to something and later remove something that is not available in my Tenant.

At the end, if we are unable to see and deleted stuff Entra is trying to use, in this case a Subscription and a Workbook, we can do nothing to solve the issue.

Right?

1 answer

Pranay Reddy Madireddy 625 Reputation points Microsoft Vendor

2024-11-15T18:58:27.16+00:00

Hi Ludwig Wurmannstätter
Open PowerShell and connect to your Azure account by using the Connect-AzAccount cmdlet.

Execute the following command to select the subscription that contains the workspace you wish to delete:

Set-AzContext -SubscriptionId <SubscriptionId>

Run the following command to delete the workspace:

Remove-AzOperationalInsightsWorkspace -ResourceGroupName <ResourceGroupName> -Name <WorkspaceName>

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Insufficient permissions when I click on Log Analytics or Workbooks

1 answer

Your answer