> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/knowledge-base/how-to-articles/send-devolutions-server-logs-to-azure-log-analytics.md).

# Send Devolutions Server logs to Azure Log Analytics

This guide provides instructions for creating and configuring all the components needed to send Devolutions Server logs to Azure Log Analytics.

{% hint style="info" %}
Devolutions Server only forwards connection **Activity** and **Administration** logs to Azure Log Analytics, not all log types. If you have audit requirements, confirm this subset covers your needs before relying on it as your only audit trail.
{% endhint %}

### Create a new app registration

1. Open the Azure portal and navigate to ***App Registrations***.
2. Click on ***New Registration***.
3. Give your app a name and click ***Register*** (no Redirect URL is necessary).
4. Under ***Supported account types***, select ***Accounts in this organizational directory only***.

### Retrieve client ID and tenant ID

After registration, locate ***Client ID*** and ***Tenant ID*** under the ***Overview*** section. These will be required later.

### Create a client secret

1. Navigate to ***Certificates & secrets***.
2. Click on ***New client secret*** to create a secret.
3. Save the secret value securely, as it will be used later in Devolutions Server.
4. Once the secret expires, you must renew it and update it in Devolutions Server; otherwise, log ingestion will stop.

### Set up a Data Collection Endpoint (DCE)

Create a Data Collection Endpoint (DCE) in Azure to receive requests from Devolutions Server.

{% hint style="info" %}
In Devolutions Server, this corresponds to the ***Azure Endpoint*** field.
{% endhint %}

### Create an Azure Log Analytics table

Building the table from Microsoft's generic sample-data flow will create flat columns that don't match this structure, and every field beyond `ReportType` and `MachineName` will come through empty. Create the table manually with the schema below instead. Create the table with the following columns (all `string` unless noted):

| Column             | Type     |
| ------------------ | -------- |
| TimeGenerated      | datetime |
| ReportType         | string   |
| MachineName        | string   |
| User               | string   |
| ConnectionName     | string   |
| ConnectionId       | string   |
| VaultName          | string   |
| VaultId            | string   |
| Message            | string   |
| LogDate            | string   |
| ConnectionType     | string   |
| ConnectionUsername | string   |
| Machine            | string   |
| Ticket             | string   |
| ActiveTime         | string   |
| OnOpenComment      | string   |
| OnCloseComment     | string   |

### Retrieve immutable ID and stream name

Once the ***Log analytics*** table is created, locate the ***Immutable ID*** and ***Stream Name*** for log streaming.

### Configure the DCR transformation

The Data Collection Rule's transform (`transformKql`) is what maps the incoming CLEF JSON onto the table schema above. Without it, the fields will not populate even if the table and permissions are otherwise correct. Set the transform to:

```kql
| extend TimeGenerated = todatetime(['@t'])
| extend p = parse_json(tostring(Properties))
| project TimeGenerated, ReportType, MachineName,
    User = tostring(p.User),
    ConnectionName = tostring(p.ConnectionName),
    ConnectionId = tostring(p.ConnectionId),
    VaultName = tostring(p.VaultName),
    VaultId = tostring(p.VaultId),
    Message = tostring(p.Message),
    LogDate = tostring(p.LogDate),
    ConnectionType = tostring(p.ConnectionType),
    ConnectionUsername = tostring(p.ConnectionUsername),
    Machine = tostring(p.Machine),
    Ticket = tostring(p['Ticket#']),
    ActiveTime = tostring(p.ActiveTime),
    OnOpenComment = tostring(p.OnOpenComment),
    OnCloseComment = tostring(p.OnCloseComment)
```

### **Assign permissions to the Data Collection Rule (DCR)**

1. From the DCR in Azure, head to ***Access Control (IAM)*** – ***Add role assignment***.
2. Select ***Monitoring Metrics Publisher***, then ***Next***.
3. Check ***User, group, or service principal***, and click on ***Select members***.
4. Click on the application created during registration. Click on ***Review + assign*** to make sure everything is in order before saving.

{% hint style="info" %}
See [Microsoft documentation](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-api?utm_source=chatgpt.com\&tabs=dcr#assign-permissions-to-a-dcr) for more details on Data Collection Rule (DCR).
{% endhint %}

### Test and activate logging

Click ***Test Connection*** to verify your credentials, then generate a connection activity in Devolutions Server and confirm the corresponding row appears in Log Analytics with its fields populated.

{% hint style="warning" %}
***Test Connection*** only validates the credentials used to reach the endpoint, it does not send an actual log entry. A green result confirms connectivity, not that ingestion or the transform is configured correctly. Always verify with a real event afterward.
{% endhint %}

### Devolutions Server configuration

1. Open the Devolutions Server web service.
2. Go to ***Administration - Server settings - Logging***.
3. Enter the information.

![](https://cdnweb.devolutions.net/docs/DVLS6035_2025_3.png)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.devolutions.net/server/knowledge-base/how-to-articles/send-devolutions-server-logs-to-azure-log-analytics.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.