Keep legacy Azure Firewall logs until structured-log delivery is confirmed

Source facts

Microsoft advises retaining the existing Azure Firewall diagnostic configuration alongside the new structured-log configuration until delivery in the new format is confirmed. Its guidance allows up to 30 minutes for structured records to begin appearing. When both legacy diagnostic and structured logs are required, Microsoft specifies at least two diagnostic settings for each firewall. Microsoft Learn.

Applicability

Use this review when changing an existing firewall’s log format. Identify the current queries, alerts and destination tables, together with the new structured-log configuration. Keep this migration separate from an unrelated firewall policy change.

DSE recommendation

DSE recommends an explicit logging handoff checklist based on representative records. Inventory consumers of the old table and decide how each will be adapted. Schedule a period of parallel observation, nominate the person who can approve removal, and retain the old configuration until evidence meets that decision. Review collection and retention choices with the logging owner.

Verification

Generate approved benign traffic and compare its timestamp, firewall identity and relevant rule information in the old and new records. Run each adapted query or alert against the new data. Record delivery latency and missing fields. Remove the legacy setting only through the approved change once collection and downstream consumption have both been demonstrated.

Official references

Microsoft Learn: Monitor Azure Firewall.