{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/",
        "slug": "dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/"
        },
        "title": "Choose ACI diagnostic settings when the workspace cannot accept legacy key-based logging",
        "summary": "Legacy Container Instances logging requires public workspace access and local authentication; diagnostic settings use a different supported path.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:25:13+00:00",
        "modified_at": "2026-09-10T02:04:56+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 227,
        "potentially_affected": "Azure Container Instances log collection into Log Analytics workspaces.",
        "dse_recommendation": "Identify the integration before changing workspace access, and validate the replacement tables and queries.",
        "primary_source": {
            "name": "Collect & analyze resource logs - Azure Container Instances | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-log-analytics",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>The legacy Container Instances integration requires a workspace key, publicly accessible Log Analytics workspace and enabled local authentication. It does not support private endpoints.</p>\n<p>Microsoft documents diagnostic settings as an alternative that supports private-endpoint workspaces and does not require a workspace key because Resource Manager handles authentication. It sends logs to standard Azure Monitor tables instead of the legacy custom tables. <a href=\"https://learn.microsoft.com/en-us/azure/container-instances/container-instances-log-analytics\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Identify how each container group currently sends logs and which tables its queries and alerts use. Do not infer the collection path solely from the presence of a workspace destination.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends choosing a supported collection path before restricting workspace access or disabling local authentication. Review the expected destination tables with the monitoring owner and update dependent queries as part of the same controlled change. Avoid reopening public access merely to preserve an unidentified legacy configuration. Keep workspace keys out of diagnostic tickets and migration evidence.</p>\n<h2>Verification</h2>\n<p>Emit an approved harmless log message and container event through the intended configuration. Confirm they appear in the expected tables and that the revised queries find them. Verify the desired workspace access settings separately. Retain the group identity, integration choice and observed records so a successful deployment setting is not mistaken for proof that alerting still consumes the correct data.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/container-instances/container-instances-log-analytics\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Collect &amp; analyze resource logs</a>. Source retrieved September 9, 2026.</p>",
        "content_text": "Source facts\nThe legacy Container Instances integration requires a workspace key, publicly accessible Log Analytics workspace and enabled local authentication. It does not support private endpoints.\nMicrosoft documents diagnostic settings as an alternative that supports private-endpoint workspaces and does not require a workspace key because Resource Manager handles authentication. It sends logs to standard Azure Monitor tables instead of the legacy custom tables. Microsoft Learn.\nApplicability\nIdentify how each container group currently sends logs and which tables its queries and alerts use. Do not infer the collection path solely from the presence of a workspace destination.\nDSE recommendation\nDSE recommends choosing a supported collection path before restricting workspace access or disabling local authentication. Review the expected destination tables with the monitoring owner and update dependent queries as part of the same controlled change. Avoid reopening public access merely to preserve an unidentified legacy configuration. Keep workspace keys out of diagnostic tickets and migration evidence.\nVerification\nEmit an approved harmless log message and container event through the intended configuration. Confirm they appear in the expected tables and that the revised queries find them. Verify the desired workspace access settings separately. Retain the group identity, integration choice and observed records so a successful deployment setting is not mistaken for proof that alerting still consumes the correct data.\nOfficial references\nMicrosoft Learn: Collect & analyze resource logs. Source retrieved September 9, 2026.",
        "content_markdown": "## Source facts\n\nThe legacy Container Instances integration requires a workspace key, publicly accessible Log Analytics workspace and enabled local authentication. It does not support private endpoints.\n\nMicrosoft documents diagnostic settings as an alternative that supports private-endpoint workspaces and does not require a workspace key because Resource Manager handles authentication. It sends logs to standard Azure Monitor tables instead of the legacy custom tables. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-log-analytics).\n\n## Applicability\n\nIdentify how each container group currently sends logs and which tables its queries and alerts use. Do not infer the collection path solely from the presence of a workspace destination.\n\n## DSE recommendation\n\nDSE recommends choosing a supported collection path before restricting workspace access or disabling local authentication. Review the expected destination tables with the monitoring owner and update dependent queries as part of the same controlled change. Avoid reopening public access merely to preserve an unidentified legacy configuration. Keep workspace keys out of diagnostic tickets and migration evidence.\n\n## Verification\n\nEmit an approved harmless log message and container event through the intended configuration. Confirm they appear in the expected tables and that the revised queries find them. Verify the desired workspace access settings separately. Retain the group identity, integration choice and observed records so a successful deployment setting is not mistaken for proof that alerting still consumes the correct data.\n\n## Official references\n\n[Microsoft Learn: Collect & analyze resource logs](https://learn.microsoft.com/en-us/azure/container-instances/container-instances-log-analytics). Source retrieved September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Choose ACI diagnostic settings when the workspace cannot accept legacy key-based logging",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/",
                "headline": "Choose ACI diagnostic settings when the workspace cannot accept legacy key-based logging",
                "description": "Legacy Container Instances logging requires public workspace access and local authentication; diagnostic settings use a different supported path.",
                "abstract": "Legacy Container Instances logging requires public workspace access and local authentication; diagnostic settings use a different supported path.",
                "articleBody": "Source facts\nThe legacy Container Instances integration requires a workspace key, publicly accessible Log Analytics workspace and enabled local authentication. It does not support private endpoints.\nMicrosoft documents diagnostic settings as an alternative that supports private-endpoint workspaces and does not require a workspace key because Resource Manager handles authentication. It sends logs to standard Azure Monitor tables instead of the legacy custom tables. Microsoft Learn.\nApplicability\nIdentify how each container group currently sends logs and which tables its queries and alerts use. Do not infer the collection path solely from the presence of a workspace destination.\nDSE recommendation\nDSE recommends choosing a supported collection path before restricting workspace access or disabling local authentication. Review the expected destination tables with the monitoring owner and update dependent queries as part of the same controlled change. Avoid reopening public access merely to preserve an unidentified legacy configuration. Keep workspace keys out of diagnostic tickets and migration evidence.\nVerification\nEmit an approved harmless log message and container event through the intended configuration. Confirm they appear in the expected tables and that the revised queries find them. Verify the desired workspace access settings separately. Retain the group identity, integration choice and observed records so a successful deployment setting is not mistaken for proof that alerting still consumes the correct data.\nOfficial references\nMicrosoft Learn: Collect & analyze resource logs. Source retrieved September 9, 2026.",
                "datePublished": "2026-09-10T00:25:13+00:00",
                "dateModified": "2026-09-10T02:04:56+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-403-choose-aci-diagnostic-settings-when-the-workspace-cannot-accept-legacy-key-based/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Choose ACI diagnostic settings when the workspace cannot accept legacy key-based logging"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 227,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Collect & analyze resource logs - Azure Container Instances | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-log-analytics"
                }
            }
        ]
    }
}