Log Analytics granular RBAC is additive: a separate broader role grant can override the practical restriction of a conditional assignment. Microsoft also requires resource-context queries to use workspaces configured as Require workspace permissions, with ABAC applied to every relevant workspace. Under Use resources or workspace permissions, resource read permission grants access to all logs and bypasses workspace conditions. Microsoft Learn.
\nThese conditions govern queries, not the exported data’s continuing access policy. LAQueryLogs can record whether a query used an applicable condition through ConditionalDataAccess, when query diagnostics are enabled. Microsoft Learn.
\nUse this review for Azure Monitor Log Analytics workspaces using granular RBAC conditions. Inventory every workspace contributing to the reader’s resource-context query, not just the workspace where the new assignment was created.
\nDSE recommends testing with the intended reader’s complete effective role set. Identify broader grants before removing anything, and coordinate required changes with the access owner. Review the workspace access mode and conditions together. Maintain separate authorization for exported or replicated copies; do not assume a successful restricted query establishes the policy of downstream data.
\nChoose known permitted and excluded records, then query through both the intended resource context and workspace context using the test identity. Compare visible rows with the approved conditions and inspect ConditionalDataAccess where available. Investigate any broader result before closing the access change. Retain the role assignments, workspace modes, query scope and observed rows as one reproducible test.
\n