Diagnostic Settings disappear in Azure Monitor

Question

Diagnostic Settings disappear in Azure Monitor

YYz11 40

Hello - today, we noticed that all our diagnostic settings disappear. When we tried to re-create them to stream to an event hub, there is no subscription to be selected. Has anyone ever seen this?

Thanks.

Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-02T17:22:41.84+00:00

Hello @YYz11@YYz11 Thank you for posting your query on Microsoft Q&A platform,

We are looking into this issue and will keep you posted updates.

Thanks,

Suchitra.
Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-02T18:26:40.14+00:00
Hello @YYz11@YYz11

Could you please check below settings and let me know if it is enabled or not?

In Azure Portal, Go to Microsoft Entra ID → Enterprise applications.

Search for Azure Monitor System or AzureApplicationInsights.

Open the application and go to Properties.

Find the setting Enabled for users to sign in?

Check if it is enabled or not, If not then Switch it to Yes.

Within a few minutes, logs started flowing again and Subscription activity logs were restored.

Resource diagnostic logs resumed as normal.

Thanks,

Suchitra.
YYz11 40 Reputation points

2026-04-02T18:44:01.7566667+00:00

Hi Suchitra, thanks for your response. We don't have these enterprise applications - these weren't required when we created dignostic settings previously.
Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-02T19:36:02.75+00:00
Hello @YYz11@YYz11

Event hubs must be in the same region as the resource that you're monitoring if the resource is regional. Diagnostic settings can't access event hubs when virtual networks are enabled. You must enable Allow trusted Microsoft services to bypass this firewall setting in event hubs so that the Azure Monitor diagnostic settings service is granted access to your event hub resources. The shared access policy for an Event Hubs namespace defines the permissions that the streaming mechanism has. Streaming to event hubs requires Manage, Send, and Listen permissions. To update the diagnostic setting to include streaming, you must have the ListKey permission on that Event Hubs authorization rule.

Could you please share a bit more detail?

Which resource type (Storage account, VM, App Service, etc.) are you trying to hook diagnostic settings to?

Is this only happening in one subscription or across all subscriptions in your tenant?

What role(s) do you have on the subscription and on the Event Hubs namespace?

Are there any firewall or private endpoint rules on the Event Hubs namespace?

Thanks,
Suchitra.
YYz11 40 Reputation points

2026-04-02T20:01:02.1166667+00:00

Hi - we have the diagnostic settings from yesterday and they disappeared today and something must be off. BTW, I'm following another Q and A article today which seems to be same issue as mine - https://dori-uw-1.kuma-moon.com/en-us/answers/questions/5848496/unable-to-create-a-diagnostic-setting-in-monitorin - and to answer your questions. I'm trying to hook storage accounts to diagnostic settings. Basically to forward Azure events to Event hub for consumption by a 3rd party SIEM. And this is happening to all subscriptions (we have several subscriptions and I'm the owner of all of them). I'm not aware of any firewall or private endpoint rules on Event Hubs namespace. As I said earlier, this was working yesterday and now they don't. Thanks again.

1 answer

Your answer

Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-02T17:22:41.84+00:00

Hello @YYz11@YYz11 Thank you for posting your query on Microsoft Q&A platform,

We are looking into this issue and will keep you posted updates.

Thanks,

Suchitra.
Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-02T18:26:40.14+00:00

Hello @YYz11@YYz11

Could you please check below settings and let me know if it is enabled or not?

In Azure Portal, Go to Microsoft Entra ID → Enterprise applications.

Search for Azure Monitor System or AzureApplicationInsights.

Open the application and go to Properties.

Find the setting Enabled for users to sign in?

Check if it is enabled or not, If not then Switch it to Yes.

Within a few minutes, logs started flowing again and Subscription activity logs were restored.

Resource diagnostic logs resumed as normal.

Thanks,

Suchitra.
YYz11 40 Reputation points

2026-04-02T18:44:01.7566667+00:00

Hi Suchitra, thanks for your response. We don't have these enterprise applications - these weren't required when we created dignostic settings previously.
Suchitra Suregaunkar 11,635 Reputation points Microsoft External Staff Moderator

2026-04-02T19:36:02.75+00:00

Hello @YYz11@YYz11

Event hubs must be in the same region as the resource that you're monitoring if the resource is regional. Diagnostic settings can't access event hubs when virtual networks are enabled. You must enable Allow trusted Microsoft services to bypass this firewall setting in event hubs so that the Azure Monitor diagnostic settings service is granted access to your event hub resources. The shared access policy for an Event Hubs namespace defines the permissions that the streaming mechanism has. Streaming to event hubs requires Manage, Send, and Listen permissions. To update the diagnostic setting to include streaming, you must have the ListKey permission on that Event Hubs authorization rule.

Could you please share a bit more detail?

Which resource type (Storage account, VM, App Service, etc.) are you trying to hook diagnostic settings to?

Is this only happening in one subscription or across all subscriptions in your tenant?

What role(s) do you have on the subscription and on the Event Hubs namespace?

Are there any firewall or private endpoint rules on the Event Hubs namespace?

Thanks,
Suchitra.
YYz11 40 Reputation points

2026-04-02T20:01:02.1166667+00:00

Hi - we have the diagnostic settings from yesterday and they disappeared today and something must be off. BTW, I'm following another Q and A article today which seems to be same issue as mine - https://dori-uw-1.kuma-moon.com/en-us/answers/questions/5848496/unable-to-create-a-diagnostic-setting-in-monitorin - and to answer your questions. I'm trying to hook storage accounts to diagnostic settings. Basically to forward Azure events to Event hub for consumption by a 3rd party SIEM. And this is happening to all subscriptions (we have several subscriptions and I'm the owner of all of them). I'm not aware of any firewall or private endpoint rules on Event Hubs namespace. As I said earlier, this was working yesterday and now they don't. Thanks again.

Answer 1

YYz11 40

Update - this was fixed by MS over the weekend. Not sure what they did but all is good now. Thanks Suchitra Suregaunkar - appreciate your help.

0 comments

Share via

Diagnostic Settings disappear in Azure Monitor

1 answer

Your answer