Skip to content

Upwind: support Log Analytics workspace in a different resource group (v3.0.3)#14649

Open
yael-nisanov wants to merge 2 commits into
Azure:masterfrom
yael-nisanov:fix-cross-rg-workspace
Open

Upwind: support Log Analytics workspace in a different resource group (v3.0.3)#14649
yael-nisanov wants to merge 2 commits into
Azure:masterfrom
yael-nisanov:fix-cross-rg-workspace

Conversation

@yael-nisanov

Copy link
Copy Markdown
Contributor

Change(s):

  • Added a WorkspaceResourceGroup parameter to the Upwind Function App ARM template (azuredeploy_UpwindLogsLoader_API_FunctionApp.json), defaulting to the deployment's resource group so existing deployments are unaffected.
  • The UpwindLogsAssets_CL custom table is now created via a nested deployment scoped to the workspace's resource group (previously a top-level child resource, which ARM can only create in the deployment's own resource group).
  • The Data Collection Rule's workspace destination ID now resolves using the workspace's resource group.
  • Added an optional "Log Analytics Workspace Resource Group" field to the deploy UI form (createUiDef.json); falls back to the deployment resource group when left empty.
  • Documented the new parameter in the README, connector instructions, and release notes.
  • Bumped the solution to 3.0.3 and regenerated the package with the V3 packaging tool (createSolutionV3.ps1).

Reason for Change(s):

  • Customer-reported deployment failure: when the Log Analytics workspace resides in a different resource group than the one the template is deployed to, deployment fails with Failed to perform 'write' on resource(s) of type workspaces/tables, because the parent resource ... was not found. Customers organizing resources by purpose/project could not keep the connector resources separate from the workspace's resource group.

Version Updated:

  • Yes, solution version bumped from 3.0.2 to 3.0.3 (data connector solution; no detections/analytic rules involved).

Testing Completed:

  • Yes. All edited JSON files validated; package regenerated via the V3 tool with ARM-TTK: 48/49 tests pass, and the single failure (IDs Should Be Derived From ResourceIDs on the generated contentProductId) is pre-existing — the published 3.0.2 package fails the same test.

Checked that the validations are passing and have addressed any issues that are present:

  • Yes

🤖 Generated with Claude Code

… group (v3.0.3)

The Function App ARM template assumed the Log Analytics workspace lives
in the deployment's resource group: the custom table was declared as a
top-level child resource and the DCR destination resolved the workspace
ID in the current resource group, so deployments failed with "parent
resource was not found" when the workspace resides elsewhere.

- Add WorkspaceResourceGroup parameter (defaults to the deployment's
  resource group, so existing deployments are unaffected)
- Create the UpwindLogsAssets_CL table via a nested deployment scoped
  to the workspace's resource group
- Resolve the DCR workspace destination ID with the workspace's
  resource group
- Add an optional workspace resource group field to the deploy UI form
- Document the new parameter in README and connector instructions
- Bump solution to 3.0.3 and regenerate the package via the V3 tool

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@yael-nisanov
yael-nisanov requested review from a team as code owners July 9, 2026 13:53
…ce group in DCR dependsOn

ARM resolves resourceId() in the deployment's resource group, but the
nested table deployment is scoped to WorkspaceResourceGroup, so the
unqualified reference failed template validation with "resource is not
defined in the template" when deploying cross-RG.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@v-atulyadav
v-atulyadav requested a review from Copilot July 10, 2026 02:36
@v-atulyadav v-atulyadav self-assigned this Jul 10, 2026
@v-atulyadav v-atulyadav added the Solution Solution specialty review needed label Jul 10, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Upwind solution to support deploying the connector when the target Log Analytics workspace is in a different resource group, and bumps the solution version to 3.0.3.

Changes:

  • Added WorkspaceResourceGroup to deployment parameters and deploy UI, defaulting to the deployment resource group.
  • Moved custom table creation to a nested deployment scoped to the workspace’s resource group and updated DCR dependencies/IDs accordingly.
  • Updated docs/release notes and bumped package/solution versions from 3.0.2 to 3.0.3.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
Solutions/Upwind/ReleaseNotes.md Adds 3.0.3 release note describing the new workspace RG support.
Solutions/Upwind/README.md Documents the new WorkspaceResourceGroup parameter.
Solutions/Upwind/Package/mainTemplate.json Bumps version/description and updates connector instructions to mention the new parameter.
Solutions/Upwind/Data/Solution_UpwindLogsLoader.json Bumps solution version to 3.0.3 for packaging metadata.
Solutions/Upwind/Data Connectors/createUiDef.json Adds an optional UI field for workspace RG and wires it into template parameters.
Solutions/Upwind/Data Connectors/azuredeploy_UpwindLogsLoader_API_FunctionApp.json Adds WorkspaceResourceGroup, scopes table creation via nested deployment, and updates DCR dependency.
Solutions/Upwind/Data Connectors/UpwindLogsLoader_API_FunctionApp.json Updates connector deployment instructions to mention WorkspaceResourceGroup.

Comment on lines +20 to +26
"WorkspaceResourceGroup": {
"defaultValue": "[resourceGroup().name]",
"type": "String",
"metadata": {
"description": "Name of the resource group containing the Log Analytics / Microsoft Sentinel workspace. Defaults to the resource group of this deployment. Set this when the workspace lives in a different resource group than the one you are deploying to."
}
},
Comment on lines +38 to +42
"constraints": {
"required": false,
"regex": "^$|^[-\\w\\._\\(\\)]{1,90}$",
"validationMessage": "Please enter a valid resource group name."
}
@@ -126,7 +133,8 @@
"mainRuleName": "[concat('upwind-dcr-', uniqueString(resourceGroup().id))]",
"tableName": "UpwindLogsAssets_CL",
@v-atulyadav

Copy link
Copy Markdown
Collaborator

Hi @yael-nisanov,
Please review the suggestions above and address them accordingly. Also, share screenshots that the connector is running successfully, along with the invocation logs. Thanks
.

@v-atulyadav

Copy link
Copy Markdown
Collaborator

hi @yael-nisanov,
Please review the suggestions above and address them accordingly. Also, please share screenshots confirming that the connector is running successfully, along with the corresponding invocation logs. Thanks

@v-atulyadav

Copy link
Copy Markdown
Collaborator

Hi @yael-nisanov,
Please review the suggestions above and address them accordingly. Also, please share screenshots confirming that the connector is running successfully, along with the corresponding invocation logs. Thanks

1 similar comment
@v-atulyadav

Copy link
Copy Markdown
Collaborator

Hi @yael-nisanov,
Please review the suggestions above and address them accordingly. Also, please share screenshots confirming that the connector is running successfully, along with the corresponding invocation logs. Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Solution Solution specialty review needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants