LogAnalytics Workspace stuck in pending state

Hi @Jesus Socas We have analyzed the issue you reported regarding the Log Analytics Workspace struck in pending state. Based on our investigation this behavior is most likely caused by a soft-deleted Log Analytics Workspace. In Azure, when a workspace is deleted, it is retained in a soft-delete state for a limited period (typically up to 14 days). During this time:

• The workspace may not be visible in the Azure portal
• The workspace name remains reserved
• Any attempt to recreate or delete the same workspace results in a conflict (409) error. 

This is expected platform behavior and is not related to the Bicep template or deployment configuration.

To resolve the issue, please follow one of the options below:

1) Recover the Workspace (Recommended)

• If you want to reuse the same workspace:

az monitor log-analytics workspace list-deleted

• If the workspace appears in the list:

az monitor log-analytics workspace recover \

  --resource-group <resource-group-name> \

  --workspace-name <workspace-name>

2) Permanently Delete (Purge) the Workspace

 If you do not need the workspace anymore and want to reuse the name:

az monitor log-analytics workspace delete \

 --resource-group <resource-group-name> \

  --workspace-name <workspace-name> \

  --force true

Please read the document for more information Delete and recover a Log Analytics workspace

If you have any further questions or need assistance with this answer, please click "Comment". I have also reached out to you via private message for a few details, so please share them. If you find the answer helpful, please click upvote. This helps the community by allowing others with similar queries to easily find the solution.

Hello Jesus Socas,

Greetings! Thanks for raising this question in the Q&A forum.

The error you are seeing "Workspace cannot be restored while current provisioning state is not Succeeded" is a classic sign that your Log Analytics workspace is caught in Azure's soft-delete state with an incomplete or stuck provisioning operation. This happens when a workspace was previously deleted (or a delete was partially triggered), causing it to enter soft-delete limbo rather than being fully deleted or fully active. Any attempt to restore or recreate it while it is in this stuck state results in this Conflict error.

Here are the steps to resolve this:

Step 1: Check if the workspace is in the Recycle Bin

Go to Azure Portal > Log Analytics workspaces. On the top menu, click Open Recycle Bin. This opens a page showing workspaces in a soft-delete state that can be recovered. If your workspace appears here, it confirms it is soft-deleted and stuck which is exactly the cause of this error.

Step 2: Recover the workspace first using PowerShell

Before you can do anything else, you need to bring the workspace back to a healthy "Succeeded" state. To recover a workspace in a soft-delete state, run the Restore-AzOperationalInsightsWorkspace cmdlet:

Select-AzSubscription "your-subscription-name"

Restore-AzOperationalInsightsWorkspace `
    -ResourceGroupName "your-resource-group-name" `
    -Name "your-workspace-name" `
    -Location "your-region"

Or using Azure CLI:

az monitor log-analytics workspace recover \
    --resource-group your-resource-group-name \
    --workspace-name your-workspace-name

Wait for this command to complete and confirm the workspace provisioning state returns to Succeeded before proceeding.

Step 3: Verify the provisioning state is now Succeeded

After the recovery completes, check the workspace status in the portal or via CLI:

az monitor log-analytics workspace show \
    --resource-group your-resource-group-name \
    --workspace-name your-workspace-name \
    --query provisioningState

It should return "Succeeded". Only then is it safe to perform any further operations on it.

Step 4: If you do not want to keep the workspace, permanently delete it

If the soft-delete approach does not fit your scenario for example, in development and testing where you need to redeploy with the same workspace name you can permanently delete the workspace after recovering it. Select "Delete workspace permanently" in the Azure portal, or use the force parameter in programmatic calls. The permanent delete releases the workspace name so a new workspace can be created with the same name.

In the portal, go to the workspace, click Delete, and check the box that says Delete the workspace permanently. Then confirm.

Via CLI:

az monitor log-analytics workspace delete \
    --resource-group your-resource-group-name \
    --workspace-name your-workspace-name \
    --force true \
    --yes

Step 5: If the resource group was also deleted

If your workspace was deleted as part of a resource group delete operation, you must first re-create the resource group with the same name before attempting workspace recovery. You also need Contributor permissions to both the subscription and the resource group to perform the recovery.

Step 6: If the workspace remains stuck after recovery attempts

If the workspace does not return to Succeeded state after running the recovery command, this indicates a platform-side issue and you should raise an Azure Support ticket. Include the Operation ID shown in your error message (the xxxxxx value) this is the correlation ID the support team needs to look up the stuck backend operation and manually resolve it.

Go to Azure Portal > Help + Support > New support request and select Log Analytics as the service.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,
Jerald Felix.