Microsoft.OperationalInsights workspaces/tables 2025-07-01

Bicep resource definition

The workspaces/tables resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.OperationalInsights/workspaces/tables resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.OperationalInsights/workspaces/tables@2025-07-01' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    plan: 'string'
    restoredLogs: {
      endRestoreTime: 'string'
      sourceTable: 'string'
      startRestoreTime: 'string'
    }
    retentionInDays: int
    schema: {
      columns: [
        {
          dataTypeHint: 'string'
          description: 'string'
          displayName: 'string'
          name: 'string'
          type: 'string'
        }
      ]
      description: 'string'
      displayName: 'string'
      name: 'string'
    }
    searchResults: {
      description: 'string'
      endSearchTime: 'string'
      limit: int
      query: 'string'
      startSearchTime: 'string'
    }
    totalRetentionInDays: int
  }
}

Property Values

Microsoft.OperationalInsights/workspaces/tables

Column

RestoredLogs

Schema

SearchResults

TableProperties

Usage Examples

Bicep Samples

A auditlog example of deploying Operational Insights Workspaces Tables.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

var auditLogTableName = 'AuditLog_CL'
var auditLogColumns = [
  {
    name: 'appId'
    type: 'string'
  }
  {
    name: 'correlationId'
    type: 'string'
  }
  {
    name: 'TimeGenerated'
    type: 'datetime'
  }
]

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  name: auditLogTableName
  parent: workspace
  properties: {
    schema: {
      columns: auditLogColumns
      name: auditLogTableName
    }
  }
}

A basic example of deploying Operational Insights Workspaces Tables.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

var sentinelTiAlertsTableName = 'SentinelTIAlerts_CL'
var sentinelTiAlertsColumns = [
  {
    name: 'ConfidenceScore'
    type: 'int'
  }
  {
    type: 'string'
    name: 'ExternalIndicatorId'
  }
  {
    name: 'IndicatorType'
    type: 'string'
  }
  {
    name: 'Indicator'
    type: 'string'
  }
  {
    name: 'TimeGenerated'
    type: 'datetime'
  }
  {
    name: 'MatchType'
    type: 'string'
  }
  {
    name: 'OriginTimestamp'
    type: 'datetime'
  }
  {
    name: 'Details'
    type: 'dynamic'
  }
]

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  name: sentinelTiAlertsTableName
  parent: workspace
  properties: {
    retentionInDays: 30
    schema: {
      columns: sentinelTiAlertsColumns
      name: sentinelTiAlertsTableName
    }
    totalRetentionInDays: 30
  }
}

A datacollectionlogs example of deploying Operational Insights Workspaces Tables.

param location string = 'westeurope'
param resourceName string = 'acctest0001'

var dataCollectionLogColumns = [
  {
    name: 'RawData'
    type: 'string'
  }
  {
    type: 'string'
    name: 'FilePath'
  }
  {
    type: 'datetime'
    name: 'TimeGenerated'
  }
]
var dataCollectionLogTableName = 'DataCollectionLog_CL'

resource workspace 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {
  name: resourceName
  location: location
  properties: {
    features: {
      disableLocalAuth: false
      enableLogAccessUsingOnlyResourcePermissions: true
    }
    publicNetworkAccessForIngestion: 'Enabled'
    publicNetworkAccessForQuery: 'Enabled'
    retentionInDays: 30
    sku: {
      name: 'PerGB2018'
    }
    workspaceCapping: {
      dailyQuotaGb: -1
    }
  }
}

resource table 'Microsoft.OperationalInsights/workspaces/tables@2022-10-01' = {
  name: dataCollectionLogTableName
  parent: workspace
  properties: {
    schema: {
      columns: dataCollectionLogColumns
      name: dataCollectionLogTableName
    }
  }
}

ARM template resource definition

The workspaces/tables resource type can be deployed with operations that target:

• Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.OperationalInsights/workspaces/tables resource, add the following JSON to your template.

{
  "type": "Microsoft.OperationalInsights/workspaces/tables",
  "apiVersion": "2025-07-01",
  "name": "string",
  "properties": {
    "plan": "string",
    "restoredLogs": {
      "endRestoreTime": "string",
      "sourceTable": "string",
      "startRestoreTime": "string"
    },
    "retentionInDays": "int",
    "schema": {
      "columns": [
        {
          "dataTypeHint": "string",
          "description": "string",
          "displayName": "string",
          "name": "string",
          "type": "string"
        }
      ],
      "description": "string",
      "displayName": "string",
      "name": "string"
    },
    "searchResults": {
      "description": "string",
      "endSearchTime": "string",
      "limit": "int",
      "query": "string",
      "startSearchTime": "string"
    },
    "totalRetentionInDays": "int"
  }
}

Property Values

Microsoft.OperationalInsights/workspaces/tables

Column

RestoredLogs

Schema

SearchResults

TableProperties

Usage Examples

Terraform (AzAPI provider) resource definition

The workspaces/tables resource type can be deployed with operations that target:

• Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.OperationalInsights/workspaces/tables resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.OperationalInsights/workspaces/tables@2025-07-01"
  name = "string"
  parent_id = "string"
  body = {
    properties = {
      plan = "string"
      restoredLogs = {
        endRestoreTime = "string"
        sourceTable = "string"
        startRestoreTime = "string"
      }
      retentionInDays = int
      schema = {
        columns = [
          {
            dataTypeHint = "string"
            description = "string"
            displayName = "string"
            name = "string"
            type = "string"
          }
        ]
        description = "string"
        displayName = "string"
        name = "string"
      }
      searchResults = {
        description = "string"
        endSearchTime = "string"
        limit = int
        query = "string"
        startSearchTime = "string"
      }
      totalRetentionInDays = int
    }
  }
}

Property Values

Microsoft.OperationalInsights/workspaces/tables

Column

RestoredLogs

Schema

SearchResults

TableProperties

Usage Examples

Terraform Samples

A auditlog example of deploying Operational Insights Workspaces Tables.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

locals {
  audit_log_table_name = "AuditLog_CL"
  audit_log_columns = [
    {
      "name" : "appId",
      "type" : "string"
    },
    {
      "name" : "correlationId",
      "type" : "string"
    },
    {
      "name" : "TimeGenerated",
      "type" : "datetime"
    }
  ]
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "table" {
  type      = "Microsoft.OperationalInsights/workspaces/tables@2022-10-01"
  parent_id = azapi_resource.workspace.id
  name      = local.audit_log_table_name
  body = {
    properties = {
      schema = {
        name    = local.audit_log_table_name
        columns = local.audit_log_columns
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

A basic example of deploying Operational Insights Workspaces Tables.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

locals {
  sentinel_ti_alerts_table_name = "SentinelTIAlerts_CL"
  sentinel_ti_alerts_columns = [
    {
      "name" : "ConfidenceScore",
      "type" : "int"
    },
    {
      "name" : "ExternalIndicatorId",
      "type" : "string"
    },
    {
      "name" : "IndicatorType",
      "type" : "string"
    },
    {
      "name" : "Indicator",
      "type" : "string"
    },
    {
      "name" : "TimeGenerated",
      "type" : "datetime"
    },
    {
      "name" : "MatchType",
      "type" : "string"
    },
    {
      "name" : "OriginTimestamp",
      "type" : "datetime"
    },
    {
      "name" : "Details",
      "type" : "dynamic"
    }
  ]
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "table" {
  type      = "Microsoft.OperationalInsights/workspaces/tables@2022-10-01"
  parent_id = azapi_resource.workspace.id
  name      = local.sentinel_ti_alerts_table_name
  body = {
    properties = {
      schema = {
        name    = local.sentinel_ti_alerts_table_name
        columns = local.sentinel_ti_alerts_columns
      }
      retentionInDays      = 30
      totalRetentionInDays = 30
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

A datacollectionlogs example of deploying Operational Insights Workspaces Tables.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

locals {
  data_collection_log_table_name = "DataCollectionLog_CL"
  data_collection_log_columns = [
    {
      "name" : "RawData",
      "type" : "string"
    },
    {
      "name" : "FilePath",
      "type" : "string"
    },
    {
      "name" : "TimeGenerated",
      "type" : "datetime"
    }
  ]
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "workspace" {
  type      = "Microsoft.OperationalInsights/workspaces@2022-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    properties = {
      features = {
        disableLocalAuth                            = false
        enableLogAccessUsingOnlyResourcePermissions = true
      }
      publicNetworkAccessForIngestion = "Enabled"
      publicNetworkAccessForQuery     = "Enabled"
      retentionInDays                 = 30
      sku = {
        name = "PerGB2018"
      }
      workspaceCapping = {
        dailyQuotaGb = -1
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "table" {
  type      = "Microsoft.OperationalInsights/workspaces/tables@2022-10-01"
  parent_id = azapi_resource.workspace.id
  name      = local.data_collection_log_table_name
  body = {
    properties = {
      schema = {
        name    = local.data_collection_log_table_name
        columns = local.data_collection_log_columns
      }
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}