Need help to identify objects related to “Action required: Prepare for the retirement of the Azure Monitor Log Analytics beta API on 31 March 2026”

Hello NCTalan,

Thank you for reaching out to the Microsoft Q&A forum.

you’re right that the Service Health blade won’t show any “impacted resources” for this retirement notice—calls to the Log Analytics beta API aren’t tracked as a discrete Azure resource. To figure out who’s hitting the beta endpoint, you’ll need to start capturing data-plane calls and/or AAD token requests:

1. Enable diagnostic logging on your Log Analytics workspaces – In the Azure portal go to your workspace > Diagnostic settings > + Add diagnostic setting – Under “Log” select the categories: • QueryLogs (or DataPlaneRequests/Operations depending on your region) • Administrative (if available) – Send them to another Log Analytics workspace (or Event Hub/Storage) – Then in that target workspace run a Kusto query to look for “/beta/workspaces/” in the request URL. For example:

AzureDiagnostics
| where Category == "QueryLogs"
| where tostring(RequestUri_s) contains "/beta/workspaces/"
| summarize Count = count() by CallerIpAddress_s, Identity_s, bin(TimeGenerated, 1h)

This will show you source IPs and AAD identities that are calling the beta endpoint.

2. Check Azure AD sign-in logs for data-plane tokens

– In Azure AD > Monitoring > Sign-ins, filter by “Resource” = https://api.loganalytics.io (and/or https://api.loganalytics.io/beta) – This surfaces which service principals or users requested tokens for the Log Analytics data-plane. You’ll see the app registration names or user UPNs.

3.Grep your code/repos/pipelines for “/beta/workspaces”

– If you have any custom scripts, Power BI datasets, Logic Apps, Functions, etc., search for references to the beta endpoint and replace them with the v1 endpoint.

Once you’ve identified the callers you can update them to use the GA endpoint (https://api.loganalytics.io/v1/workspaces/{id}/query) or the new batch API format before the March 31, 2026 retirement.

Hope this helps! Let me know if you have further questions?

Reference list

• Migrate from batch and beta queries to the standard Log Analytics query API https://learn.microsoft.com/azure/azure-monitor/logs/api/migrate-batch-and-beta
• Configure diagnostic settings for a Log Analytics workspace https://learn.microsoft.com/azure/azure-monitor/essentials/diagnostic-settings#sending-microsoftoperationalinsights-workspaces-logs
• Azure AD sign-in logs overview https://learn.microsoft.com/azure/active-directory/reports-monitoring/concept-sign-ins
• Reliability recommendation: retiring the batch & beta Log Analytics API https://learn.microsoft.com/azure/advisor/advisor-reference-reliability-recommendations#the-batch-api-in-azure-monitor-log-analytics-is-retiring

Hello,

I've tried the second point (Check Azure AD sign-in logs for data-plane tokens) and got no results.

Now i'd like to try the first one.
There are 4 log analytics workspaces, including one dedicated to Sentinel.

In the Settings, I can't find the options you mentionned.

"Under “Log” select the categories: • QueryLogs (or DataPlaneRequests/Operations depending on your region) • Administrative (if available)"

What should I choose here please ?

Thanks a lot in advance 🙏