Build Lab — Route the Activity Log into a workspace and query it

This is the hands-on twin of "Route the logs once, and only where they earn their keep". There you decided which mechanism moves telemetry. Here you build the mechanism, wait for data to land, and query it — including the part nobody tells you about, which is that logs do not arrive instantly and a working pipeline looks broken for the first few minutes.

Before you start

• Azure CLI, and az login completed.
• Contributor on a subscription — you will create one resource group and one workspace.
• Roughly 15 minutes of patience between step 3 and step 5. Use it to read the design lab again.

What you are building

Step 1 — a resource group to hold the workspace

Step 2 — create the workspace

Keep the returned id — the next step needs it. You can always fetch it again:

Step 3 — route the Activity Log at subscription scope

Two things to notice. This is a subscription-scope diagnostic setting — the Activity Log is a subscription-level source, not a per-resource one, which is why it has its own command. And you named a workspace here; you could have added a storage account and an event hub to the same setting, which is exactly the claim the design lab tested.

Step 4 — generate an event to look for

Creating a resource group is itself an Administrative operation, so this is the event you will hunt for.

Step 5 — wait, then query

Give it 10 to 15 minutes. Then:

Checkpoint

You should see at least one row naming a resource-group write operation and your own account as Caller.

If you get zero rows, do not assume it is broken. That is the single most useful thing this lab teaches: ingestion latency is real, and every "my logging is not working" incident starts here. Re-run the query a few minutes later before changing anything. Note the customerId in the query above — the workspace GUID, not its resource id. Using the wrong one is the second most common mistake.

Why this matters on the exam

Teardown

Deleting the resource group removes the workspace with it. Confirm the subscription setting is gone — this one lives outside the resource group and will otherwise keep routing:

If it did not work

Next

Re-read the design lab's compare table — diagnostic setting, data export, cross-workspace query. You have now built the first of the three, and the row that said "a copy crosses the boundary; a query does not" should read very differently now that you have watched a copy take fifteen minutes to arrive.