How to authenticate to log analytics using workspace identity in Fabric notebook or pipeline instead

Hi SravyaNeela ,

You can connect to Azure Log Analytics from Fabric with below things.

1. Query logs (read-only) via the Azure Monitor Logs API/SDK
2. Ingest logs (write) via the Logs Ingestion API (DCR/DCE)

1. Query Log Analytics (read) from a Fabric notebook using workspace identity.

Package/API: azure-monitor-query with DefaultAzureCredential. The SDK requests a token for the correct audience and will use the managed identity when executed by a pipeline notebook activity “Run as Workspace identity.

from azure.identity import DefaultAzureCredential
from azure.monitor.query import LogsQueryClient
from azure.monitor.query import LogsQueryStatus

workspace_id = "<YOUR-LAW-WORKSPACE-ID>" # GUID from LAW Overview
kql = "Usage | take 5" # Replace with your KQL
timespan = "PT1H" # last 1 hour
credential = DefaultAzureCredential()
client = LogsQueryClient(credential)
response = client.query_workspace(
workspace_id=workspace_id,
query=kql,
timespan=timespan
)
if response.status == LogsQueryStatus.PARTIAL:
print("Partial results:")
table = response.partial_data
elif response.status == LogsQueryStatus.SUCCESS:
table = response.tables[0]

columns = [c.name for c in table.columns]
print(columns)
for row in table.rows:
print(dict(zip(columns, row)))
else:
raise RuntimeError(f"Query failed: {response.error}")

Note: The SDK targets the Azure Monitor Logs endpoint and supports DefaultAzureCredential (Managed Identity) natively. Query endpoint has moved to https://api.loganalytics.azure.com (SDK handles this).

2. Ingest to Log Analytics via Logs Ingestion API (write) using workspace identity. send custom logs (JSON) to a LAW table via your DCR/DCE. grant the Fabric workspace identity the Data Collection Rule Data Sender role on the DCR. Auth audience: https://monitor.azure.com/.default (Logs Ingestion API)

import json
import requests
from azure.identity import DefaultAzureCredential

dce_endpoint = "https://<your-dce-name>.<region>.ingest.monitor.azure.com"
dcr_immutable_id = "/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Insights/dataCollectionRules/<dcrName>"
stream_name = "Custom-MyTable_CL"

ingest_url = f"{dce_endpoint}/dataCollectionRules/{dcr_immutable_id}/streams/{stream_name}?api-version=2023-01-01"

token = DefaultAzureCredential().get_token("https://monitor.azure.com/.default").token

headers = {
"Authorization": f"Bearer {token}",
"Content-Type": "application/json; charset=utf-8"
}

payload = [
{
"TimeGenerated": "2026-02-16T10:30:00Z",
"Level": "Information",
"Message": "Hello from Fabric workspace identity",
"Source": "fabric-notebook"
}
]

resp = requests.post(ingest_url, headers=headers, data=json.dumps(payload))
resp.raise_for_status()
print("Ingestion status:", resp.status_code)

Note: The Logs Ingestion API requires a DCR and accepts JSON payloads, you authenticate against monitor.azure.com. Using managed identity for Logs Ingestion is supported; the key point is get a bearer token for monitor.azure.com and ensure the identity has Data Collection Rule Data Sender on the DCR.

To fix “Unauthorized” error, try below things to fix the issue.

1. Place the notebook inside a Pipeline “Notebook activity” and set Run as = Workspace identity. You create the notebook connection in the activity UI.

2. On the Log Analytics Workspace --> Access control (IAM) --> Add role assignment --> add your Fabric Workspace Identity with Log Analytics Reader or Reader.

3. On the DCR --> Access control (IAM) --> add the workspace identity with Data Collection Rule Data Sender.

4. Token audience mismatch:

Query --> token for https://api.loganalytics.azure.com/.default.
Ingestion --> token for https://monitor.azure.com/.default.

5. If your tenant restricts service principals or requires admin consent, your Fabric workspace identity may be blocked from acquiring tokens or accessing resources. Your Entra admin may need to approve the enterprise app.

I hope this information helps. Please do let us know if you have any further queries.

Regards,

Dinesh