{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/",
        "slug": "dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/"
        },
        "title": "Check the replica's usable log history before a workspace switchover",
        "summary": "Does enabling Log Analytics workspace replication copy the historical logs already available in the primary?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:27:21+00:00",
        "modified_at": "2026-09-10T01:23:48+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 253,
        "potentially_affected": "Supported Log Analytics workspaces configured for cross-region workspace replication.",
        "dse_recommendation": "Compare each essential query's lookback requirement with the data actually present in the inactive region.",
        "primary_source": {
            "name": "Enhance resilience by replicating your Log Analytics workspace across regions - Azure Monitor | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Log Analytics workspace replication copies table schemas but only replicates logs ingested after activation; older logs are not backfilled. Microsoft recommends accumulating at least a week of data before switchover. The inactive region can be queried through the Log Analytics API to check its actual contents. Switchover is an operator-triggered action, not automatic failover. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<p>For DCR-based ingestion, the rules must be associated with the workspace&#8217;s data collection endpoint for replication. Auxiliary tables are unsupported, and Microsoft says not to enable replication on workspaces containing them. Alert rules are not automatically replicated with the workspace. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Review supported Log Analytics workspaces configured for cross-region workspace replication. Check the current region-pair and feature-support matrix before using this readiness check; it is not approval for every workspace-dependent service.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends listing the lookback period and required tables for each essential investigation and alert query. Compare those requirements with the inactive region&#8217;s actual history, not the primary&#8217;s retention setting. Record any shortened investigation horizon explicitly. Keep alert-rule availability as a separate readiness item, and assign the switchover decision to an operator with the appropriate authority.</p>\n<h2>Verification</h2>\n<p>Query the inactive region for representative old and recent events in each required table. Confirm the targeted region, successful replication configuration and applicable ingestion endpoint associations. Exercise the important queries against that data before an approved switchover test. Preserve missing-history findings rather than interpreting a successful replication setting as evidence of a complete historical copy.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Log Analytics workspace replication</a>.</p>",
        "content_text": "Source facts\nLog Analytics workspace replication copies table schemas but only replicates logs ingested after activation; older logs are not backfilled. Microsoft recommends accumulating at least a week of data before switchover. The inactive region can be queried through the Log Analytics API to check its actual contents. Switchover is an operator-triggered action, not automatic failover. Microsoft Learn.\nFor DCR-based ingestion, the rules must be associated with the workspace’s data collection endpoint for replication. Auxiliary tables are unsupported, and Microsoft says not to enable replication on workspaces containing them. Alert rules are not automatically replicated with the workspace. Microsoft Learn.\nApplicability\nReview supported Log Analytics workspaces configured for cross-region workspace replication. Check the current region-pair and feature-support matrix before using this readiness check; it is not approval for every workspace-dependent service.\nDSE recommendation\nDSE recommends listing the lookback period and required tables for each essential investigation and alert query. Compare those requirements with the inactive region’s actual history, not the primary’s retention setting. Record any shortened investigation horizon explicitly. Keep alert-rule availability as a separate readiness item, and assign the switchover decision to an operator with the appropriate authority.\nVerification\nQuery the inactive region for representative old and recent events in each required table. Confirm the targeted region, successful replication configuration and applicable ingestion endpoint associations. Exercise the important queries against that data before an approved switchover test. Preserve missing-history findings rather than interpreting a successful replication setting as evidence of a complete historical copy.\nOfficial references\nMicrosoft Learn: Log Analytics workspace replication.",
        "content_markdown": "## Source facts\n\nLog Analytics workspace replication copies table schemas but only replicates logs ingested after activation; older logs are not backfilled. Microsoft recommends accumulating at least a week of data before switchover. The inactive region can be queried through the Log Analytics API to check its actual contents. Switchover is an operator-triggered action, not automatic failover. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication).\n\nFor DCR-based ingestion, the rules must be associated with the workspace’s data collection endpoint for replication. Auxiliary tables are unsupported, and Microsoft says not to enable replication on workspaces containing them. Alert rules are not automatically replicated with the workspace. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication).\n\n## Applicability\n\nReview supported Log Analytics workspaces configured for cross-region workspace replication. Check the current region-pair and feature-support matrix before using this readiness check; it is not approval for every workspace-dependent service.\n\n## DSE recommendation\n\nDSE recommends listing the lookback period and required tables for each essential investigation and alert query. Compare those requirements with the inactive region’s actual history, not the primary’s retention setting. Record any shortened investigation horizon explicitly. Keep alert-rule availability as a separate readiness item, and assign the switchover decision to an operator with the appropriate authority.\n\n## Verification\n\nQuery the inactive region for representative old and recent events in each required table. Confirm the targeted region, successful replication configuration and applicable ingestion endpoint associations. Exercise the important queries against that data before an approved switchover test. Preserve missing-history findings rather than interpreting a successful replication setting as evidence of a complete historical copy.\n\n## Official references\n\n[Microsoft Learn: Log Analytics workspace replication](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Check the replica's usable log history before a workspace switchover",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/",
                "headline": "Check the replica's usable log history before a workspace switchover",
                "description": "Does enabling Log Analytics workspace replication copy the historical logs already available in the primary?",
                "abstract": "Does enabling Log Analytics workspace replication copy the historical logs already available in the primary?",
                "articleBody": "Source facts\nLog Analytics workspace replication copies table schemas but only replicates logs ingested after activation; older logs are not backfilled. Microsoft recommends accumulating at least a week of data before switchover. The inactive region can be queried through the Log Analytics API to check its actual contents. Switchover is an operator-triggered action, not automatic failover. Microsoft Learn.\nFor DCR-based ingestion, the rules must be associated with the workspace’s data collection endpoint for replication. Auxiliary tables are unsupported, and Microsoft says not to enable replication on workspaces containing them. Alert rules are not automatically replicated with the workspace. Microsoft Learn.\nApplicability\nReview supported Log Analytics workspaces configured for cross-region workspace replication. Check the current region-pair and feature-support matrix before using this readiness check; it is not approval for every workspace-dependent service.\nDSE recommendation\nDSE recommends listing the lookback period and required tables for each essential investigation and alert query. Compare those requirements with the inactive region’s actual history, not the primary’s retention setting. Record any shortened investigation horizon explicitly. Keep alert-rule availability as a separate readiness item, and assign the switchover decision to an operator with the appropriate authority.\nVerification\nQuery the inactive region for representative old and recent events in each required table. Confirm the targeted region, successful replication configuration and applicable ingestion endpoint associations. Exercise the important queries against that data before an approved switchover test. Preserve missing-history findings rather than interpreting a successful replication setting as evidence of a complete historical copy.\nOfficial references\nMicrosoft Learn: Log Analytics workspace replication.",
                "datePublished": "2026-09-10T00:27:21+00:00",
                "dateModified": "2026-09-10T01:23:48+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-275-check-the-replica-s-usable-log-history-before-a-workspace-switchover/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check the replica's usable log history before a workspace switchover"
                },
                "articleSection": [
                    "Business Continuity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 253,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Enhance resilience by replicating your Log Analytics workspace across regions - Azure Monitor | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-replication"
                }
            }
        ]
    }
}