# Keep legacy Azure Firewall logs until structured-log delivery is confirmed

> Use observed records as the handoff point between logging formats.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:51+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Use observed records as the handoff point between logging formats.

## Potentially affected

Use this review when changing an existing firewall's log format. Identify the current queries, alerts and destination tables, together with the new structured-log configuration. Keep this migration separate from an unrelated firewall policy change.

## DSE recommendation

DSE recommends an explicit logging handoff checklist based on representative records.

## Article

## Source facts

Microsoft advises retaining the existing Azure Firewall diagnostic configuration alongside the new structured-log configuration until delivery in the new format is confirmed. Its guidance allows up to 30 minutes for structured records to begin appearing. When both legacy diagnostic and structured logs are required, Microsoft specifies at least two diagnostic settings for each firewall. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall).

## Applicability

Use this review when changing an existing firewall’s log format. Identify the current queries, alerts and destination tables, together with the new structured-log configuration. Keep this migration separate from an unrelated firewall policy change.

## DSE recommendation

DSE recommends an explicit logging handoff checklist based on representative records. Inventory consumers of the old table and decide how each will be adapted. Schedule a period of parallel observation, nominate the person who can approve removal, and retain the old configuration until evidence meets that decision. Review collection and retention choices with the logging owner.

## Verification

Generate approved benign traffic and compare its timestamp, firewall identity and relevant rule information in the old and new records. Run each adapted query or alert against the new data. Record delivery latency and missing fields. Remove the legacy setting only through the approved change once collection and downstream consumption have both been demonstrated.

## Official references

[Microsoft Learn: Monitor Azure Firewall](https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall).

## Primary reference

- Name: Monitor Azure Firewall | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/firewall/monitor-firewall
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep legacy Azure Firewall logs until structured-log delivery is confirmed,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-069-keep-legacy-azure-firewall-logs-until-structured-log-delivery-is-confirmed/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.