{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/", "slug": "dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables", "url": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/" }, "title": "Choose an owned workspace before requiring protected Application Insights tables", "summary": "Can an Application Insights managed workspace be reused or configured with protected tables?", "format": { "slug": "explainer", "name": "Explainer" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:26+00:00", "modified_at": "2026-09-10T02:14:31+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 270, "potentially_affected": "Workspace-based Application Insights resources with automatically created managed Log Analytics workspaces.", "dse_recommendation": "Resolve workspace ownership and protected-table requirements before designing additional collection around a managed workspace.", "primary_source": { "name": "Application Insights managed workspaces - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/managed-workspaces", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Application Insights automatically creates a managed Log Analytics workspace when deployment does not specify one. That workspace serves only the creating Application Insights resource: it cannot accept another instance, diagnostic settings or custom logs. Some settings, including quotas, remain adjustable, but the workspace cannot be repurposed. Its managed resource group’s deny assignment blocks protected-table configuration; Microsoft directs sensitive Application Insights data needing that protection to a workspace the customer owns. Microsoft Learn.

\n

Applicability

\n

Inspect the actual workspace association and managing resource rather than inferring ownership from its name. This decision concerns workspace-based resources and required table protection, not a new classic Application Insights deployment. Define whether the requirement is exclusive application storage, shared collection or protected tables before selecting the destination.

\n

DSE recommendation

\n

Resolve workspace ownership and protected-table requirements before designing additional collection around a managed workspace. If the requirements need an owned workspace, have the application and monitoring owners plan that association explicitly. Review the intended data access, networking and retention configuration for the destination. Do not respond to the documented restriction by attempting to remove service-managed protection or by repeatedly deploying unsupported data sources.

\n

Verification

\n

In a representative nonproduction deployment, inspect the linked workspace and verify that it has the ownership model the design requires. Test approved telemetry queries and the required table-protection configuration at the destination. Keep the original workspace until its data and removal obligations have been separately reviewed. Record evidence of the actual association and protection behavior; successfully changing a quota does not establish that the managed workspace supports other uses.

\n

Official references

\n

Microsoft Learn: Managed workspaces in Application Insights. Source reviewed September 9, 2026.

", "content_text": "Source facts\nApplication Insights automatically creates a managed Log Analytics workspace when deployment does not specify one. That workspace serves only the creating Application Insights resource: it cannot accept another instance, diagnostic settings or custom logs. Some settings, including quotas, remain adjustable, but the workspace cannot be repurposed. Its managed resource group’s deny assignment blocks protected-table configuration; Microsoft directs sensitive Application Insights data needing that protection to a workspace the customer owns. Microsoft Learn.\nApplicability\nInspect the actual workspace association and managing resource rather than inferring ownership from its name. This decision concerns workspace-based resources and required table protection, not a new classic Application Insights deployment. Define whether the requirement is exclusive application storage, shared collection or protected tables before selecting the destination.\nDSE recommendation\nResolve workspace ownership and protected-table requirements before designing additional collection around a managed workspace. If the requirements need an owned workspace, have the application and monitoring owners plan that association explicitly. Review the intended data access, networking and retention configuration for the destination. Do not respond to the documented restriction by attempting to remove service-managed protection or by repeatedly deploying unsupported data sources.\nVerification\nIn a representative nonproduction deployment, inspect the linked workspace and verify that it has the ownership model the design requires. Test approved telemetry queries and the required table-protection configuration at the destination. Keep the original workspace until its data and removal obligations have been separately reviewed. Record evidence of the actual association and protection behavior; successfully changing a quota does not establish that the managed workspace supports other uses.\nOfficial references\nMicrosoft Learn: Managed workspaces in Application Insights. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nApplication Insights automatically creates a managed Log Analytics workspace when deployment does not specify one. That workspace serves only the creating Application Insights resource: it cannot accept another instance, diagnostic settings or custom logs. Some settings, including quotas, remain adjustable, but the workspace cannot be repurposed. Its managed resource group’s deny assignment blocks protected-table configuration; Microsoft directs sensitive Application Insights data needing that protection to a workspace the customer owns. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/app/managed-workspaces).\n\n## Applicability\n\nInspect the actual workspace association and managing resource rather than inferring ownership from its name. This decision concerns workspace-based resources and required table protection, not a new classic Application Insights deployment. Define whether the requirement is exclusive application storage, shared collection or protected tables before selecting the destination.\n\n## DSE recommendation\n\nResolve workspace ownership and protected-table requirements before designing additional collection around a managed workspace. If the requirements need an owned workspace, have the application and monitoring owners plan that association explicitly. Review the intended data access, networking and retention configuration for the destination. Do not respond to the documented restriction by attempting to remove service-managed protection or by repeatedly deploying unsupported data sources.\n\n## Verification\n\nIn a representative nonproduction deployment, inspect the linked workspace and verify that it has the ownership model the design requires. Test approved telemetry queries and the required table-protection configuration at the destination. Keep the original workspace until its data and removal obligations have been separately reviewed. Record evidence of the actual association and protection behavior; successfully changing a quota does not establish that the managed workspace supports other uses.\n\n## Official references\n\n[Microsoft Learn: Managed workspaces in Application Insights](https://learn.microsoft.com/en-us/azure/azure-monitor/app/managed-workspaces). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/", "url": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose an owned workspace before requiring protected Application Insights tables", "item": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/", "url": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/", "headline": "Choose an owned workspace before requiring protected Application Insights tables", "description": "Can an Application Insights managed workspace be reused or configured with protected tables?", "abstract": "Can an Application Insights managed workspace be reused or configured with protected tables?", "articleBody": "Source facts\nApplication Insights automatically creates a managed Log Analytics workspace when deployment does not specify one. That workspace serves only the creating Application Insights resource: it cannot accept another instance, diagnostic settings or custom logs. Some settings, including quotas, remain adjustable, but the workspace cannot be repurposed. Its managed resource group’s deny assignment blocks protected-table configuration; Microsoft directs sensitive Application Insights data needing that protection to a workspace the customer owns. Microsoft Learn.\nApplicability\nInspect the actual workspace association and managing resource rather than inferring ownership from its name. This decision concerns workspace-based resources and required table protection, not a new classic Application Insights deployment. Define whether the requirement is exclusive application storage, shared collection or protected tables before selecting the destination.\nDSE recommendation\nResolve workspace ownership and protected-table requirements before designing additional collection around a managed workspace. If the requirements need an owned workspace, have the application and monitoring owners plan that association explicitly. Review the intended data access, networking and retention configuration for the destination. Do not respond to the documented restriction by attempting to remove service-managed protection or by repeatedly deploying unsupported data sources.\nVerification\nIn a representative nonproduction deployment, inspect the linked workspace and verify that it has the ownership model the design requires. Test approved telemetry queries and the required table-protection configuration at the destination. Keep the original workspace until its data and removal obligations have been separately reviewed. Record evidence of the actual association and protection behavior; successfully changing a quota does not establish that the managed workspace supports other uses.\nOfficial references\nMicrosoft Learn: Managed workspaces in Application Insights. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:22:26+00:00", "dateModified": "2026-09-10T02:14:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-570-choose-an-owned-workspace-before-requiring-protected-application-insights-tables/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose an owned workspace before requiring protected Application Insights tables" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Explainer", "Information priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 270, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Application Insights managed workspaces - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/app/managed-workspaces" } } ] } }