removal of log analytics from preprod subscirption

Hello @Gulavani, Amruta

Thank you for reaching out to Microsoft Q&A.

I understand that you are unable to remove the Log Analytics workspace from the preprod subscription through the Terraform pipeline and would like to clean it up.

By default, when a Log Analytics workspace is deleted, Azure places it in a soft-delete state for 14 days so it can be recovered. If the requirement is to remove the workspace permanently and release the workspace name immediately, the workspace needs to be permanently deleted.

If you are using Terraform, please update the AzureRM provider features block as below so that Terraform permanently deletes the Log Analytics workspace during destroy:

provider "azurerm" {
 features {
 log_analytics_workspace {
 permanently_delete_on_destroy = true
 }
 }
}

If the workspace is already in a soft-delete state, please recover the workspace first and then permanently delete it. You can also use Azure CLI to permanently delete the workspace:

az monitor log-analytics workspace delete --resource-group <resource-group-name> --workspace-name <workspace-name> --force

Before retrying the deletion, please also verify whether there are any related solutions, linked services, Azure Automation links, or resource locks associated with the workspace, as these may need to be removed depending on the exact error returned by the pipeline.

Reference:

Microsoft documentation: Delete and recover a Log Analytics workspace

Azure CLI reference: az monitor log-analytics workspace delete

Terraform provider reference: AzureRM provider features block

If you continue to experience the issue after following the above steps, please share the exact error message along with a screenshot so that we can investigate further.

If the answer is helpful, please click "upvote" it. If you have extra questions about this answer, please click "Comment".

Hi Amruta,

Microsoft Q&A users cannot remove a Log Analytics workspace from your subscription directly. You will need to delete it from the Azure portal, Azure CLI, or Terraform with an identity that has the required permissions.

Please check these items first:

1. Make sure the Terraform pipeline service principal has delete permission on the workspace, for example Log Analytics Contributor, Contributor, or Owner.

Check if the workspace or resource group has a delete lock:

az lock list --resource-group <resource-group-name> -o table

Check whether Azure Policy is denying the delete operation.

Check whether the workspace is managed by Terraform state. If it was created outside Terraform, import it first or delete it manually after approval.

If you want to delete it using CLI, you can test with:

az monitor log-analytics workspace delete \
  --resource-group <resource-group-name> \
  --workspace-name <workspace-name>

If you need permanent deletion instead of soft-delete:

az monitor log-analytics workspace delete \
  --resource-group <resource-group-name> \
  --workspace-name <workspace-name> \
  --force

Please also share the exact Terraform error message. Without the error, it is hard to tell whether this is RBAC, resource lock, policy, Terraform state, or dependency-related.

Can we please have a call, instead of discussing this on chat for so long, It would be better to discuss it on call.

It would help us resolve this issue as soon as possible. We are stuck because of this.

Can we please have a call, instead of discussing this on chat for so long, It would be better to discuss it on call.

It would help us resolve this issue as soon as possible. We are stuck because of this.