Quick Note — Recommend a Solution for Routing Logs
AZ-305 › Unit 1 › Design solutions for logging and monitoring › Recommend a solution for routing logs
Quick Note — Recommend a Solution for Routing Logs
This lesson focuses on one of the most overlooked yet operationally critical Azure design decisions: how logs get from where they are produced to where they need to be consumed. You have already chosen a workspace topology (LO-1); now the question is plumbing — which routing mechanism connects each telemetry source to the correct sink, and how do you enforce that plumbing at scale? The lesson covers diagnostic settings, the three destination types (Log Analytics workspace, Azure Storage, Event Hubs), Data Collection Rules (DCR), Azure Monitor Agent (AMA), partner-solution integrations, and Azure Policy enforcement.…
Retrieval target
- Recommend a Solution for Routing Logs
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Resource logs | Azure platform logs emitted at the resource layer (Key Vault, Cosmos DB, VM, etc.) describing operations performed inside the resource. They are not collected by default — you must add a Diagnostic Setting on each resource to route them to a destination. Contents vary by resource type. |
Activity log | A single, subscription-scoped log of management-plane operations — who did what to which resource and when (start, write, delete, role assignment, service-health events). Retained for 90 days then deleted; route to Log Analytics, Storage, or Event Hub via Diagnostic Settings to keep longer. |
| What are the three Microsoft Entra ID (tenant-layer) log types, and what does each capture? | Sign-in logs — user authentication attempts and the resources accessed. Audit logs — changes to tenant objects (user/group/app create, update, delete). Provisioning logs — activity of provisioning services that create users in SaaS apps (ServiceNow, Salesforce, etc.). All three can be routed via Diagnostic Settings to Log Analytics, Storage, or Event Hub. |
Diagnostic Setting | A per-resource (or per-subscription, per-tenant) configuration that routes platform logs and metrics to one or more destinations: Log Analytics workspace, Storage account, Event Hub, or a Partner solution. Without one, resource logs are emitted but not persisted; platform metrics are still collected automatically and stay queryable in Metrics Explorer, so a setting is only needed to route them elsewhere. A resource can have multiple Diagnostic Settings, each fanning out to different destinations. |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.