{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/", "slug": "dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request", "url": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/" }, "title": "Distinguish Logs ingestion authorization failures from a wrongly addressed request", "summary": "Which identifiers and permission should be checked when the Logs ingestion API returns 403 or 404?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:15+00:00", "modified_at": "2026-09-10T02:11:18+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 249, "potentially_affected": "Applications sending data through the Azure Monitor Logs ingestion API using the documented DCE-based custom-table workflow.", "dse_recommendation": "Check the DCR's immutable identifier and ingestion permission separately before widening an application's access.", "primary_source": { "name": "Tutorial: Send data to Azure Monitor Logs with Logs ingestion API (Azure portal) - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

The Logs ingestion API addresses a DCR by immutableId, not its display name. Microsoft’s custom-table workflow grants the sending application Monitoring Metrics Publisher on that DCR, providing Microsoft.Insights/Telemetry/Write. Role propagation can take up to 30 minutes; an early request can return 403. Microsoft Learn.

\n

For the tutorial’s 404 case, Microsoft directs operators to check the immutable ID and the table’s _CL suffix, with a stream named Custom-<TableName_CL>. Its portal workflow requires a DCE; template or Logs management API creation can instead use a DCR endpoint. Microsoft Learn.

\n

Applicability

\n

Review applications sending data through the Azure Monitor Logs ingestion API using the documented DCE-based custom-table workflow. Do not apply its URI construction blindly to another ingestion method.

\n

DSE recommendation

\n

DSE recommends comparing the actual request address with the DCR JSON and intended table before changing permissions. For an authorization failure, verify the exact sending identity, assignment scope and elapsed propagation time. Keep the immutable identifier separate from friendly names in configuration records. Do not respond to a not-found error by granting subscription-wide administration.

\n

Verification

\n

Send a harmless, identifiable record through the intended client after the authorized correction. Preserve the response status and nonsensitive address components, then confirm the expected row reached the target table. If ingestion succeeds but fields are wrong, open a separate transformation investigation instead of continuing to change identity permissions. Record the corrected boundary without storing a bearer token or client secret.

\n

Official references

\n

Microsoft Learn: Logs ingestion API portal tutorial.

", "content_text": "Source facts\nThe Logs ingestion API addresses a DCR by immutableId, not its display name. Microsoft’s custom-table workflow grants the sending application Monitoring Metrics Publisher on that DCR, providing Microsoft.Insights/Telemetry/Write. Role propagation can take up to 30 minutes; an early request can return 403. Microsoft Learn.\nFor the tutorial’s 404 case, Microsoft directs operators to check the immutable ID and the table’s _CL suffix, with a stream named Custom-. Its portal workflow requires a DCE; template or Logs management API creation can instead use a DCR endpoint. Microsoft Learn.\nApplicability\nReview applications sending data through the Azure Monitor Logs ingestion API using the documented DCE-based custom-table workflow. Do not apply its URI construction blindly to another ingestion method.\nDSE recommendation\nDSE recommends comparing the actual request address with the DCR JSON and intended table before changing permissions. For an authorization failure, verify the exact sending identity, assignment scope and elapsed propagation time. Keep the immutable identifier separate from friendly names in configuration records. Do not respond to a not-found error by granting subscription-wide administration.\nVerification\nSend a harmless, identifiable record through the intended client after the authorized correction. Preserve the response status and nonsensitive address components, then confirm the expected row reached the target table. If ingestion succeeds but fields are wrong, open a separate transformation investigation instead of continuing to change identity permissions. Record the corrected boundary without storing a bearer token or client secret.\nOfficial references\nMicrosoft Learn: Logs ingestion API portal tutorial.", "content_markdown": "## Source facts\n\nThe Logs ingestion API addresses a DCR by immutableId, not its display name. Microsoft’s custom-table workflow grants the sending application Monitoring Metrics Publisher on that DCR, providing Microsoft.Insights/Telemetry/Write. Role propagation can take up to 30 minutes; an early request can return 403. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal).\n\nFor the tutorial’s 404 case, Microsoft directs operators to check the immutable ID and the table’s _CL suffix, with a stream named Custom-. Its portal workflow requires a DCE; template or Logs management API creation can instead use a DCR endpoint. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal).\n\n## Applicability\n\nReview applications sending data through the Azure Monitor Logs ingestion API using the documented DCE-based custom-table workflow. Do not apply its URI construction blindly to another ingestion method.\n\n## DSE recommendation\n\nDSE recommends comparing the actual request address with the DCR JSON and intended table before changing permissions. For an authorization failure, verify the exact sending identity, assignment scope and elapsed propagation time. Keep the immutable identifier separate from friendly names in configuration records. Do not respond to a not-found error by granting subscription-wide administration.\n\n## Verification\n\nSend a harmless, identifiable record through the intended client after the authorized correction. Preserve the response status and nonsensitive address components, then confirm the expected row reached the target table. If ingestion succeeds but fields are wrong, open a separate transformation investigation instead of continuing to change identity permissions. Record the corrected boundary without storing a bearer token or client secret.\n\n## Official references\n\n[Microsoft Learn: Logs ingestion API portal tutorial](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/", "url": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Distinguish Logs ingestion authorization failures from a wrongly addressed request", "item": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/", "url": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/", "headline": "Distinguish Logs ingestion authorization failures from a wrongly addressed request", "description": "Which identifiers and permission should be checked when the Logs ingestion API returns 403 or 404?", "abstract": "Which identifiers and permission should be checked when the Logs ingestion API returns 403 or 404?", "articleBody": "Source facts\nThe Logs ingestion API addresses a DCR by immutableId, not its display name. Microsoft’s custom-table workflow grants the sending application Monitoring Metrics Publisher on that DCR, providing Microsoft.Insights/Telemetry/Write. Role propagation can take up to 30 minutes; an early request can return 403. Microsoft Learn.\nFor the tutorial’s 404 case, Microsoft directs operators to check the immutable ID and the table’s _CL suffix, with a stream named Custom-. Its portal workflow requires a DCE; template or Logs management API creation can instead use a DCR endpoint. Microsoft Learn.\nApplicability\nReview applications sending data through the Azure Monitor Logs ingestion API using the documented DCE-based custom-table workflow. Do not apply its URI construction blindly to another ingestion method.\nDSE recommendation\nDSE recommends comparing the actual request address with the DCR JSON and intended table before changing permissions. For an authorization failure, verify the exact sending identity, assignment scope and elapsed propagation time. Keep the immutable identifier separate from friendly names in configuration records. Do not respond to a not-found error by granting subscription-wide administration.\nVerification\nSend a harmless, identifiable record through the intended client after the authorized correction. Preserve the response status and nonsensitive address components, then confirm the expected row reached the target table. If ingestion succeeds but fields are wrong, open a separate transformation investigation instead of continuing to change identity permissions. Record the corrected boundary without storing a bearer token or client secret.\nOfficial references\nMicrosoft Learn: Logs ingestion API portal tutorial.", "datePublished": "2026-09-10T00:23:15+00:00", "dateModified": "2026-09-10T02:11:18+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-521-distinguish-logs-ingestion-authorization-failures-from-a-wrongly-addressed-request/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Distinguish Logs ingestion authorization failures from a wrongly addressed request" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 249, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Tutorial: Send data to Azure Monitor Logs with Logs ingestion API (Azure portal) - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal" } } ] } }