Manage an Azure Monitor workspace

This article shows you how to create and delete an Azure Monitor workspace. When you configure Azure Monitor managed service for Prometheus, you can select an existing Azure Monitor workspace or create a new one.

Note

When you create an Azure Monitor workspace, by default a data collection rule and a data collection endpoint in the form <azure-monitor-workspace-name> will automatically be created in a resource group in the form MA_<azure-monitor-workspace-name>_<location>_managed. In case there are any Azure policies with restrictions on resource or resource group names, create an exemption to exempt these resources from evaluation.

Prerequisites

An Azure subscription. If you don't have an Azure subscription, create a free account before you begin.
A resource group to hold the Azure Monitor workspace.
The Contributor role on the resource group. You need this role to create or delete an Azure Monitor workspace.

Create an Azure Monitor workspace

Open the Azure Monitor workspaces menu in the Azure portal.
Select Create.
On Create an Azure Monitor workspace, select a Subscription and Resource group where you want to create the workspace.
Provide a Name and a Region for the workspace.
Select Review + create to create the workspace.

Use the following command to create an Azure Monitor workspace using Azure CLI.

az monitor account create --name <azure-monitor-workspace-name> --resource-group <resource-group-name> --location <location>

For Azure CLI command details, see Azure CLI for Azure Monitor workspace.

To create an Azure Monitor workspace, use one of the following Resource Manager templates with any of the standard deployment options.

{
    "$schema": "http://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "name": {
            "type": "string"
        },
        "location": {
            "type": "string",
            "defaultValue": ""
        }
    },
    "resources": [
        {
            "type": "microsoft.monitor/accounts",
            "apiVersion": "2023-04-03",
            "name": "[parameters('name')]",
            "location": "[if(empty(parameters('location')), resourceGroup().location, parameters('location'))]"
        }
    ]
}

Note

The $schema value in the ARM template (schema.management.azure.com) is the ARM template schema reference, not a deployment endpoint. You don't need to change it for Azure Government or other sovereign clouds. To deploy to Azure Government, set the active cloud before deploying:

az cloud set --name AzureUSGovernment

Azure Monitor workspace is available in Azure Government regions. For network endpoint requirements in Azure Government, see Network firewall requirements for monitoring Kubernetes clusters and Azure Monitor endpoint access and firewall configuration.

@description('Specify the name of the workspace.')
param workspaceName string

@description('Specify the location for the workspace.')
param location string = resourceGroup().location

resource workspace 'microsoft.monitor/accounts@2023-04-03' = {
  name: workspaceName
  location: location
}

When you create an Azure Monitor workspace, a new resource group is created. The resource group name has the following format: MA_<azure-monitor-workspace-name>_<location>_managed, where the tokenized elements are lowercased. The resource group contains both a data collection endpoint and a data collection rule with the same name as the workspace. The resource group and its resources are automatically deleted when you delete the workspace.

To connect your Azure Monitor managed service for Prometheus to your Azure Monitor workspace, see Collect Prometheus metrics from AKS cluster

Tip

Enable recommended alerts for your Azure Monitor workspace to monitor the ingestion limits and quotas. To enable the recommended alerts, see Enable recommended alerts for your Azure Monitor workspace.

Configure resource-context access mode

Similar to Log Analytics workspace, Azure Monitor workspaces offer a resource-context access mode to enable more granular Azure RBAC resource permissions for users querying data in a workspace. This access mode provides the following benefits:

Users do not need to know which workspace to query for the metrics they've scoped their query to
Users do not need direct access to the workspace(s) storing the metrics for their resources

For more information, see Manage access to an Azure Monitor workspace.

Delete an Azure Monitor workspace

When you delete an Azure Monitor workspace, unlike with a Log Analytics workspace, there's no soft delete operation. The data in the workspace is immediately deleted, and there's no recovery option.

Open the Azure Monitor workspaces menu in the Azure portal.
Select your workspace.
Select Delete.

To delete an Azure Monitor workspace, use az monitor account delete.

For example:

az monitor account delete --name <azure-monitor-workspace-name> --resource-group <resource-group-name>

For Azure CLI command details, see Azure CLI for Azure Monitor workspace.

Verify the deletion

When you delete an Azure Monitor workspace, Azure also removes the managed resource group in the form MA_<azure-monitor-workspace-name>_<location>_managed. To confirm the deletion, verify that this resource group no longer exists:

az group show --name MA_<azure-monitor-workspace-name>_<location>_managed

The command returns an error stating that the resource group isn't found, which confirms that the managed resources were removed.

Link a Grafana workspace

Connect an Azure Monitor workspace to an Azure Managed Grafana workspace to allow Grafana to use the Azure Monitor workspace data in a Grafana dashboard. You can connect an Azure Monitor workspace to multiple Grafana workspaces, and you can connect a Grafana workspace to multiple Azure Monitor workspaces. Azure Managed Grafana and your Azure Monitor workspace can be in different regions.

To link your self-managed Grafana instance to an Azure Monitor workspace, see Connect Grafana to Azure Monitor Prometheus metrics

Note

When you add the Azure Monitor workspace as a data source to Grafana, it's listed in as Prometheus_<azure monitor workspace query endpoint>.

Open the Azure Monitor workspace menu in the Azure portal.
Select your workspace.
Select Linked Grafana workspaces.
Select a Grafana workspace.

Create a link between the Azure Monitor workspace and the Grafana workspace by updating the Azure Kubernetes Service cluster that you're monitoring.

If your cluster is already configured to send data to an Azure Monitor managed service for Prometheus, you must disable it first using the following command:

az aks update --disable-azure-monitor-metrics -g <cluster-resource-group> -n <cluster-name>

Then, either enable or re-enable using the following command:

az aks update --enable-azure-monitor-metrics -n <cluster-name> -g <cluster-resource-group> --azure-monitor-workspace-resource-id
<azure-monitor-workspace-name-resource-id> --grafana-resource-id <grafana-workspace-name-resource-id>

The following JSON fragment from the command output confirms that Azure Monitor managed service for Prometheus is enabled:

{
    "azureMonitorProfile": {
        "metrics": {
            "enabled": true,
            "kubeStateMetrics": {
                "metricAnnotationsAllowList": "",
                "metricLabelsAllowlist": ""
            }
        }
    }
}

Next steps

Learn more about the Azure Monitor data platform.
Azure Monitor workspace overview.

Feedback

Was this page helpful?

Last updated on 2026-08-11

Manage an Azure Monitor workspace

Prerequisites

Create an Azure Monitor workspace

Configure resource-context access mode

Delete an Azure Monitor workspace

Verify the deletion

Link a Grafana workspace

Next steps

Feedback

Additional resources