AZURE application insights and log ingestion and querying from public networks

Thanks for the information, I do have some comments around the setup. Where one has several app insights and log analytics workspaces on a hub/spoke configuration. Once the AMPLs is created, integrate it ont he hub network, create a private endpoint and then link every application insights or log analytics workspaces to the AMPLS, at this point public data ingestion and querying from public networks can be disabled ? I have a few questions.

1. How many IP addresses does one need to account for ?
2. Will it just be a single DNS configuration for the private endpoint connected to the AMPLS that one needs to account for ?
3. Does every log analytics workspace require an IP address allocation ?
4. What is the total number of application insights/log analytics workspaces that can be linked to a single AMPLS ?
5. Are there any design considerations from an availability perspective when having a single AMPLS ?

Hi @MrFlinstone ,

Thank you so much for the response back, Please find the below in answers

1. How many IP addresses does one need to account for?
   A) For each resource if we enable the private end One Ip address will get assigned from the subnet you allocate. So, the number of IP addresses will depend on the number of private endpoints you create
2. Will it just be a single DNS configuration for the private endpoint connected to

the AMPLS that one needs to account for?

A) a. If You Select "Yes" (Integrate with Private DNS Zone):

Azure will automatically create and manage the necessary DNS records in the private DNS zone associated with the service you're connecting to. This simplifies DNS management significantly.

b. If You Select "No" (Do Not Integrate with Private DNS Zone):

You take full responsibility for managing DNS resolution manually.

Refer DNS Tab: https://zcusa.951200.xyz/en-us/azure/azure-monitor/logs/private-link-configure

3. Does every log analytics workspace require an IP address allocation?
   A) Each Log Analytics workspace does not require a separate IP address allocation. Instead, they will use the private IPs from the subnet allocated to the private endpoint
   Refer: https://zcusa.951200.xyz/en-us/azure/azure-monitor/logs/private-link-configure

4.What is the total number of application insights/log analytics workspaces that can be linked to a single AMPLS?
A) An AMPLS object can connect to up to 300 Log Analytics workspaces and up to 1,000 Application Insights components.

Refer: https://zcusa.951200.xyz/en-us/azure/azure-monitor/logs/private-link-design

5.Are there any design considerations from an availability perspective when having a single AMPLS?
A) Availability Considerations: When designing for availability, it's important to ensure that your AMPLS is highly available and resilient to failures. This can be achieved by:

• Using multiple private endpoints in different subnets or availability zones.
• Implementing failover mechanisms to switch to a backup endpoint in case of a failure.

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.

Hi @MrFlinstone ,
Just want to check if the above comment worked for you or else please let us know if any help, we are always here to help whenever you need us.

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.

Thanks very much for the helpful information. Wanted to understand a bit more.

As it stands, what exactly is routed through a public network if one is using log analytics workspaces and app insights? What exactly is publicly accessible ?

What would be the impact of the network changes with existing log analytics workspaces and app insights ?

How can we test that functionality still works after the implementation to ensure no unintended consequences ?

From the above, it appears that if the private endpoint is situated on the hub, only 1 IP address would be required which is that of the private endpoint ?

Having a log analytics workspace and app insights at a different region from a DR perspective and what it means from AMPLS perspective.

Hi @MrFlinstone ,
Thank you so much for the response back, please find the below inline answers

As it stands, what exactly is routed through a public network if one is using log analytics workspaces and app insights? What exactly is publicly accessible?
A) Yes, Azure Log Analytics workspace data export traffic travels over the Azure backbone network. This traffic doesn't leave the Azure network
Refer: https://zcusa.951200.xyz/en-us/azure/azure-monitor/logs/logs-data-export?tabs=portal

What would be the impact of the network changes with existing log analytics workspaces and app insights?
A). No network changes required just enable the feature form private to public

How can we test that functionality still works after the implementation to ensure no unintended consequences?
A) Create a test Log analysis workspace and application insights and and couple of resource to test vm ,storage etc

From the above, it appears that if the private endpoint is situated on the hub, only 1 IP address would be required which is that of the private endpoint?
A) 1 IP for each PAAS service when you enable a private endpoint
example: Storage 1 IP, App service 1 IP

Having a log analytics workspace and app insights at a different region from a DR perspective and what it means from AMPLS perspective.
A) Refer: https://zcusa.951200.xyz/en-us/azure/azure-monitor/app/create-workspace-resource?tabs=bicep

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.