Connect to Log Analytics & App Insights
A connection to your Azure Log Analytics workspaces and Application Insights resources so your agent can query log data directly. Learn more → Log Analytics & App Insights.
Prerequisites
- An agent in Running state
- At least one Log Analytics workspace or Application Insights resource in your agent's subscription
You don't need to add Azure subscription scope or resource group access separately. The agent discovers workspaces from the subscription it already has scope over, and assigns RBAC roles to the resource groups where your selected workspaces live.
Steps
Step 1: Open the connector wizard
- Go to Builder → Connectors
- Click Add connector
- Select Log Analytics Workspace from the connector picker
To connect Application Insights resources instead, select Application Insights. The setup flow is the same — the form shows App Insights resources instead of workspaces.
Step 2: Select workspaces
The form auto-discovers Log Analytics workspaces in your agent's subscription:
| Field | What to enter |
|---|---|
| Name | A descriptive name for this connector (e.g., production-logs) |
| Log Analytics workspace | Click the dropdown to see available workspaces. Each option shows the workspace name and resource group. Select a workspace. To connect additional workspaces, create a separate connector for each. |
| Managed identity | Select the identity your agent uses to authenticate (system-assigned or user-assigned) |
After selecting a workspace, a hint shows which resource groups will receive RBAC role assignments:
Log Analytics Reader role needed on: [list of resource groups]
If no workspaces appear in the dropdown, your subscription may not contain Log Analytics workspaces, or your account may lack Azure Resource Graph read permissions. You can add a workspace manually by entering:
- ARM resource ID — in the format:
/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{name} - Workspace name — the display name of the workspace
- Customer ID — the workspace's unique identifier (find it in the Azure portal under the workspace's Properties tab)
For Application Insights, the manual form requires the ARM resource ID and the resource name.
Step 3: Save
Click Add. The agent automatically assigns the required permissions to its managed identity and creates the connection.
Checkpoint: The connector appears in your Builder → Connectors list with a Connected status.
Step 4: Query your logs
Go to Chat and ask your agent about your log data:
What tables are available in my Log Analytics workspace?
Try a more specific query:
Show me the top 10 errors from SigninLogs in the last 24 hours
Results appear as formatted tables with an Azure Monitor badge.
Checkpoint: You see query results in chat. The agent can now include log data in incident investigations.
App Insights setup
To connect Application Insights resources, follow the same steps but select Application Insights in step 2. The differences:
| Log Analytics | App Insights | |
|---|---|---|
| Resource type | Log Analytics workspaces | Application Insights resources |
| RBAC roles assigned | Same 3 roles (Log Analytics Reader, Monitoring Reader, Reader) | Same 3 roles |
| Manual ARM format | Microsoft.OperationalInsights/workspaces/{name} | Microsoft.Insights/components/{name} |
Troubleshooting
| Issue | Solution |
|---|---|
| No workspaces in dropdown | Verify your subscription contains Log Analytics workspaces. Check Azure Resource Graph permissions. Use the manual ARM resource ID input as a fallback. |
| RBAC assignment fails | You need Owner or User Access Administrator on the target resource groups. Ask your admin to grant access or pre-assign the roles manually. |
| Queries return 403 | The managed identity may be missing Log Analytics Reader or Monitoring Reader on the target resource group. Check role assignments in the Azure portal. |
| Log Analytics not in connector picker | Refresh the page and try again. If the issue persists, check your agent's subscription scope. |
What you built
You connected your agent to Log Analytics workspaces (or Application Insights resources), giving it direct access to query your log data via KQL. The agent can now include log evidence in incident investigations, run scheduled log queries, and answer ad-hoc questions about your operational data.
Next steps
- Create a scheduled task to run recurring log queries
- Kusto Tools for deterministic, parameterized queries against ADX clusters
- Diagnose Azure observability issues with your connected log data