Treat export-job cancellation as a permanent stop with partial output left behind

Source facts

Azure Monitor Logs export jobs are a preview feature for historical records in Analytics or Basic tables; Auxiliary tables are unsupported. Microsoft says canceling a job ends it permanently and prevents retries, while data already exported remains in the destination storage account. The returned operationId is the jobId used to inspect, cancel, or retry an eligible job. Microsoft Learn.

Applicability

Use this decision for an existing export job, not a continuous export rule or a source-table deletion. Confirm the job identity, requested interval, query, and destination accounts. Review current feature restrictions before planning a replacement operation; this brief does not establish new-job eligibility.

DSE recommendation

Approve cancellation with an explicit disposition for the partial dataset and a separate plan for any later export. Have the data owner distinguish stopping further work from removing files already produced. Mark an incomplete dataset accordingly, and retain its provenance so another operator does not accept it as the requested full interval. Avoid describing cancellation as a pause.

Verification

Inspect the terminal job status and account for the output already present at every configured destination. Compare that output with the requested scope before handing it to an investigation or reporting consumer. If another export is authorized, track its job and output separately and define how the two datasets will be reconciled. Do not remove partial evidence merely because the job is no longer running.

Official references

Microsoft Learn: Run an export job in Azure Monitor Logs (preview). Source reviewed September 9, 2026.