Log Analytics is a service that helps you collect and analyze data generated by resources in your cloud and on-premises environments.

Full documentation for this integration is available in the [reference docs](https://xsoar.pan.dev/docs/reference/integrations/azure-log-analytics).

There are two authentication methods available:

 * [Cortex XSOAR Application](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#cortex-xsoar-application)
 * [Self-Deployed Application](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#self-deployed-application)

Depending on the authentication method that you use, the integration parameters might change.

#### Cortex XSOAR Azure App

To use the **Cortex XSOAR application** and allow Cortex XSOAR access to Azure Log Analytics, an administrator has to approve our app using an admin consent flow by clicking this **[link](https://oproxy.demisto.ninja/ms-azure-log-analytics)**.
After authorizing the Cortex XSOAR app, you will get an ID, Token, and Key which should be inserted in the integration instance settings fields.

**Note**: These credentials are valid for a single instance only.


#### Self-Deployed Azure App
To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal. To add the registration, go to the [Microsoft article](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app).

### Required permissions
- Azure Service Management - permission `user_impersonation` of type `Delegated`
- Log Analytics API - permission `Data.Read` of type `Delegated`

In the self-deployed mode, you can authenticate by using one of the following flows:
- Authorization Code flow
- Client Credentials flow

### Authorization Code flow

---
1. In the instance configuration, select the **Use a self-deployed Azure application - Authorization Code flow** checkbox.
2. Enter your Client ID in the **ID / Client ID** parameter. 
3. Enter your Client secret in the **Key / Client Secret** parameter.
4. Enter your tenant ID in the **Tenant ID** parameter.
5. Enter your redirect URI in the **Redirect URI** parameter.
6. Save the integration settings.
7. Run the `!azure-log-analytics-generate-login-url` command in the War Room and follow the instruction.
8. Run the ***azure-log-analytics-test*** command to test the connection and the authorization process.

### Client Credentials Flow

---
Follow these steps for client-credentials configuration.

1. In the instance configuration, select the **Use a self-deployed Azure application - Client Credentials Authorization Flow** checkbox.
2. Enter your Client ID in the **ID / Client ID** parameter. 
3. Enter your Client Secret in the **Key / Client Secret** parameter.
4. Enter your Tenant ID in the **Tenant ID** parameter.
5. Click **Test** to validate the URLs, token, and connection.

### Azure Managed Identities Authentication
##### Note: This option is relevant only if the integration is running on Azure VM.
Follow one of these steps for authentication based on Azure Managed Identities:

- ##### To use System Assigned Managed Identity
   - Select the **Use Azure Managed Identities** checkbox and leave the **Azure Managed Identities Client ID** field empty.

- ##### To use User Assigned Managed Identity
   1. Go to [Azure Portal](https://portal.azure.com/) -> **Managed Identities**
   2. Select your User Assigned Managed Identity -> copy the Client ID -> paste it in the **Azure Managed Identities Client ID** field in the instance settings.
   3. Select the **Use Azure Managed Identities** checkbox.

For more information, see [Managed identities for Azure resources](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview).

## Get the Additional Instance Parameters

To get the **Subscription ID**, **Workspace Name**, **Workspace ID** and **Resource Group** parameters, in the Azure Portal, go to **Log Analytics workspaces > YOUR-WORKSPACE > Settings** and click the **Workspace Settings** tab.