# Attach an Azure Monitor transformation to the intended data flow

> Check transformation placement when one stream feeds multiple destinations.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:52+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Check transformation placement when one stream feeds multiple destinations.

## Potentially affected

Apply this review to a proposed single-stage ingestion transformation. Identify every dataFlows entry using the affected stream, its output stream and its destination. Keep this assessment scoped to transformKql; the same source describes separate preview processing arrangements that require their own assessment.

## DSE recommendation

DSE recommends drawing the source-to-destination paths before editing the rule.

## Article

## Source facts

Microsoft places the transformKql property within a DCR dataFlows entry that pairs a source with a destination. The transformation affects that particular data flow before delivery. Reusing the same stream or destination elsewhere in the rule does not extend the transformation to those other entries. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-create).

## Applicability

Apply this review to a proposed single-stage ingestion transformation. Identify every dataFlows entry using the affected stream, its output stream and its destination. Keep this assessment scoped to transformKql; the same source describes separate preview processing arrangements that require their own assessment.

## DSE recommendation

DSE recommends drawing the source-to-destination paths before editing the rule. Mark exactly which paths should receive the transformation and which should preserve the original record. Have a second reviewer compare that intent with the specific JSON location. Keep the prior rule and representative sanitized test records with the change record.

## Verification

Submit distinguishable test records through each affected path in an approved environment. Query every destination and compare the stored fields with the expected result for that path. Confirm that an intentionally unchanged flow remains unchanged. Investigate discrepancies before rollout, and preserve both the deployed rule and the observed destination results.

## Official references

[Microsoft Learn: Create a transformation in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-create).

## Primary reference

- Name: Create a transformation in Azure Monitor - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/data-collection/data-collection-transformations-create
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Attach an Azure Monitor transformation to the intended data flow,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-008-attach-an-azure-monitor-transformation-to-the-intended-data-flow/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.