azure-observability

Standard IDs

ID	Severity	What it checks
AOBS-001	P1	No centralized Log Analytics workspace — diagnostics scattered per-resource-group with no shared query surface
AOBS-002	P2	Application Insights sampling left at 100% for a high-volume API, inflating ingestion cost
AOBS-003	P1	No alert rules/action groups defined for critical resources (App Service, SQL, Container Apps)
AOBS-004	P2	Diagnostic settings not configured to route resource logs to the central workspace

---

Check A — No centralized Log Analytics workspace (AOBS-001)

Detection

1. Grep Bicep templates for Microsoft.OperationalInsights/workspaces resources — flag if every resource group provisions its own workspace instead of resources across environments pointing at one shared (or one-per-environment) workspace with RBAC-scoped query access.
2. A fragmented-workspace setup means an incident spanning two resource groups requires cross-workspace KQL queries (workspace("other-ws").Table) instead of one query surface.

BAD — a new workspace provisioned per resource group

// resource-group-orders/main.bicep
resource ordersWorkspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  name: 'log-orders-prod-eus-001'
}
// resource-group-invoicing/main.bicep provisions its own separate workspace — no shared query surface

GOOD — one shared workspace per environment, referenced by every resource group

// shared/observability.bicep — deployed once per environment
resource sharedWorkspace 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
  name: 'log-platform-prod-eus-001'
}

// resource-group-orders/main.bicep references the shared workspace by resourceId
param sharedWorkspaceId string
resource diag 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  properties: { workspaceId: sharedWorkspaceId }
}

---

Check B — Application Insights sampling left at defaults (AOBS-002)