Account for checkpoint reset when recreating Event Hubs log ingestion

Source facts

Direct Event Hubs ingestion into Azure Monitor Logs is in public preview. Microsoft states that removing all related DCR associations stops ingestion; deleting those associations or their DCRs also resets Event Hub checkpointing. When an association is created, ingestion includes events already retained in the hub as well as new arrivals. Recreating configuration therefore needs a deliberate review of the retained-event starting point. Microsoft Learn.

Applicability

Apply this review to an existing eligible direct-ingestion setup. Confirm the Event Hub, consumer group, associations, rules, and destination table before a rebuild. Check the current preview prerequisites and regional capacity if establishing a new deployment; this article does not replace that readiness work.

DSE recommendation

Treat removal of the last ingestion association as a checkpoint change, not just temporary configuration cleanup. Record what is already stored at the destination and what remains retained at the source. Ask the ingestion owner to define how any re-read events will be recognized and reconciled. Do not assume that restoring a similarly named association preserves the former progress record.

Verification

Rehearse the approved rebuild in a test stream containing identifiable retained events and fresh arrivals. Compare destination records before and after association recreation. Preserve observed re-reading, gaps, and timing as separate findings rather than hiding them in a total row count. Use the resulting evidence to approve the production reconciliation approach before removing an existing ingestion relationship.

Official references

Microsoft Learn: Ingest Event Hubs events into Azure Monitor Logs (Public Preview). Source reviewed September 9, 2026.