Unable to edit Log Analytics workspace functions or group them by legacy category

David Alejandro Peñaloza Farias 20 Reputation points
2026-08-06T20:28:26.7766667+00:00

I am experiencing an issue with workspace functions in Azure Log Analytics.

Until recently, the Functions panel allowed us to group workspace functions by Legacy category. That option is no longer available. The Group by menu now only shows Category and Solution, and our custom legacy categories are not displayed as they were previously.

I am also unable to edit an existing workspace function:

  1. I open Log Analytics workspace → Logs → Functions.
  2. I select an existing function.
  3. I click Load to editor.
  4. The KQL code is loaded into the editor, but the tab remains a New query instead of being associated with the selected function.
  5. The Save menu only displays Save as function. It does not provide an option to update the existing function or edit its function details and legacy category.

I reproduced the same behavior:

  • In different browsers.
  • In Incognito/InPrivate mode.
  • After clearing the browser cache.
  • Using a completely empty query tab.

This does not appear to be a permissions issue. My assigned Azure role includes:

Microsoft.OperationalInsights/workspaces/savedSearches/*

There are also no deny assignments affecting my access.

Could Microsoft please confirm:

  1. Is this a known issue or a recent regression in the Azure Portal Log Analytics interface?
  2. Has the Legacy category option been intentionally removed or renamed?
  3. Are the existing legacy categories still preserved in the backend?
  4. Is there a portal-based workaround for editing existing functions without creating duplicates?

At the moment, we cannot properly organize or update our existing workspace functions through the Azure Portal.I am experiencing an issue with workspace functions in Azure Log Analytics.

Until recently, the Functions panel allowed us to group workspace functions by Legacy category. That option is no longer available. The Group by menu now only shows Category and Solution, and our custom legacy categories are not displayed as they were previously.

I am also unable to edit an existing workspace function:

  1. I open Log Analytics workspace → Logs → Functions.
  2. I select an existing function.
  3. I click Load to editor.
  4. The KQL code is loaded into the editor, but the tab remains a New query instead of being associated with the selected function.
  5. The Save menu only displays Save as function. It does not provide an option to update the existing function or edit its function details and legacy category.

I reproduced the same behavior:

  • In different browsers.
  • In Incognito/InPrivate mode.
  • After clearing the browser cache.
  • Using a completely empty query tab.

This does not appear to be a permissions issue. My assigned Azure role includes:

Microsoft.OperationalInsights/workspaces/savedSearches/*

There are also no deny assignments affecting my access.

Could Microsoft please confirm:

  1. Is this a known issue or a recent regression in the Azure Portal Log Analytics interface?
  2. Has the Legacy category option been intentionally removed or renamed?
  3. Are the existing legacy categories still preserved in the backend?
  4. Is there a portal-based workaround for editing existing functions without creating duplicates?

At the moment, we cannot properly organize or update our existing workspace functions through the Azure Portal.

Azure Monitor
Azure Monitor

An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.

0 comments
Answer accepted by question author
Jerald Felix 18,680 Reputation points Volunteer Moderator
2026-08-07T01:16:51.65+00:00

Hello David Alejandro Peñaloza Farias,

Greetings! Thanks for raising this question in the.Hello David, Greetings! Thanks for raising this question in the Q&A forum.

This is not a permissions problem. What you're seeing is a side effect of how Log Analytics now stores and manages saved queries and functions. Microsoft has moved the primary storage model for saved queries (and by extension, functions) to query packs, which organize items by Category and Solution instead of the older Legacy category field that lives on the workspace level savedSearches resource. Functions you created earlier are still stored as legacy Microsoft.OperationalInsights/workspaces/savedSearches objects with a Legacy category property, but the Functions panel Group by control and the Save dialog now default to the query pack model, so it no longer surfaces Legacy category as a grouping option and the Save menu only offers Save as function rather than a direct in place edit of the legacy object. That is why Load to editor pulls in the KQL but does not rebind the tab to the original function, and why the legacy category field is not exposed for editing.

  1. Confirm the function still exists with its legacy category intact. The legacy category is not lost, it just is not exposed in the current Functions panel UI. You can verify this directly against the resource using Azure CLI:
az rest --method get --uri "https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/savedSearches/<functionAlias>?api-version=2025-07-01"

Check the properties.category field in the response, this is your Legacy category value.

  1. Update the function through the REST API instead of the portal Save dialog. Since savedSearches is updated with a full PUT, take the JSON you retrieved in step 1, modify the properties.query, properties.displayName, or properties.category fields as needed, keep the same functionAlias, and PUT it back:
az rest --method put --uri "https://management.azure.com/subscriptions/<subscriptionId>/resourceGroups/<resourceGroup>/providers/Microsoft.OperationalInsights/workspaces/<workspaceName>/savedSearches/<functionAlias>?api-version=2025-07-01" --body '{"properties":{"etag":"*","displayName":"<FunctionName>","category":"<LegacyCategory>","query":"<UpdatedKQL>","functionAlias":"<functionAlias>","version":1}}'

This bypasses the portal Save dialog entirely and guarantees the update lands on the existing function rather than creating a duplicate.

If you need to keep working from the portal, use Save as function with the identical function name. Function alias is the unique key. Loading the function, editing the query, then choosing Save as function and typing the exact same function name will overwrite the existing object rather than create a new one. You will need to re-enter the Legacy category value manually each time in this flow since the dialog does not pre-populate it from the existing function anymore.

Do not rely on Group by to locate legacy categorized functions for now. Use the Search box in the Functions panel to find functions by name instead, since the Legacy category grouping option is not currently rendering for workspace functions created under that model.

Since this looks like an undocumented change in portal behavior rather than a documented deprecation, I would still recommend opening an Azure Support case so Microsoft can confirm whether Legacy category grouping is being intentionally retired in favor of query pack categories, or whether this is a regression. Go to Help + support in the Azure portal, create a new support request, choose issue type Technical, service Log Analytics under Monitoring, and in the description include your workspace resource ID, the exact steps you listed to reproduce this, and note that grouping by Legacy category has disappeared from the Group by dropdown and Save only offers Save as function. If your support plan is Basic, note that Basic does not include technical support cases, you would need at least a Developer support plan to open this type of ticket with Microsoft engineers.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Oldest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.