Support for log alert rules that use cross-workspace queries with resource names or qualified name identifiers will be retired on 31 May 2024

As of May 31, 2024, log alert rules will no longer support cross-workspace queries that use resource names or qualified name identifiers.

Alert rules created in the Azure portal or using the Scheduled Query Rules API version 2023-03-15-preview, using resource names (e.g. workspaces(‘AIFabrikamDemo’)) or qualified names (<subscriptionName>/<resourceGroup>/<workspaceName>) patterns in cross-resource queries will not be supported.

From now until May 31, 2024,  you will get a warning if your query uses those patterns, and from May 31,2024, the queries will not be supported.

Required Action

When creating or updating log alert rules that query data across workspaces or applications explicitly using the workspace() or app() expressions, use one of the below resource identifiers:

• GUID of workspace or application, for example:
  • workspace(“00000000-0000-0000-0000-000000000000”)
  • app(“00000000-0000-0000-0000-000000000000”)
• Identifier for the Azure resource
  • workspace(“/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Contoso/providers/Microsoft.OperationalInsights/workspaces/contosoretail”)
  • app(“/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Fabrikam/providers/microsoft.insights/components/fabrikamapp”)

Alert rules created or updated in the Azure portal prior to May 31^st 2024 or using Scheduled Query Rules API versions 2022-08-01-preview or earlier will continue to run with no issues.

Help and support

If you have questions, get answers from community experts in Microsoft Q&A. If you have a support plan and you need technical help, create a support request.