Configure a table plan in a Log Analytics workspace

Log Analytics workspaces store any type of log for any purpose. They support three types of table plans to accomplish this goal:

Table plan	Example purpose
Analytics	High-performance analytics and complex queries
Basic	Cost-effective storage for less frequently accessed data
Auxiliary / Lake	High-volume, verbose data for long-term, inexpensive storage and aggregated data trends

Review the table plan selection criteria in Table plans, and then use the following steps to configure the table.

Permissions required

Action	Permissions required
View table plan	`Microsoft.OperationalInsights/workspaces/tables/read` permissions to the Log Analytics workspace, as provided by the Log Analytics Reader built-in role, for example
Set table plan	`Microsoft.OperationalInsights/workspaces/write` and `microsoft.operationalinsights/workspaces/tables/write` permissions to the Log Analytics workspace, as provided by the Log Analytics Contributor built-in role, for example

Set the table plan

Set a custom table's plan when you create it. Azure tables default to the Analytics plan. Change the plan for any table after it's created based on these criteria:

All tables support the Analytics plan.
All DCR-based custom tables support all plans.
Azure table support for Basic and Auxiliary / Lake plans varies by table. For more information, see Logs table feature support.

Change the table plan

Change your table plans to accommodate your data usage and analysis needs. Consider the feature support of the table plan you switch to and the considerations listed here:

Original table plan	Table plan change	Considerations
Basic or Auxiliary / Lake	Analytics	You get the full set of features and capabilities in Azure Monitor Logs but the cost increases.
Analytics	Basic if the table supports those plans	- Extra billing for queries including summary rule queries. - Summary rules break if the rule uses resource query scope. - Total retention period doesn't change, but data older than 30 days is treated as long-term retention.
Analytics	Auxiliary / Lake if the table supports those plans	- Alerts stop working for that table. - Extra billing for queries including summary rule queries. - Summary rules break if the rule uses resource query scope.

Note

Table plan updates are limited to one switch per table per week.

The following examples show how to update a table's plan.

From the Log Analytics workspaces menu, select Tables.

The Tables screen lists all the tables in the workspace.
Select the context menu for the table you want to configure and select Manage table.
From the Table plan dropdown on the table configuration screen, select Analytics, Basic, or Auxiliary / Lake.

The Table plan dropdown shows the plans available for the selected table.
Select Save.

The following Azure CLI example uses the az monitor log-analytics workspace table update command. It updates the table plan by using the --plan parameter, set to Analytics or Basic.

# Set variables
resourceGroupName="<ResourceGroupName>"
workspaceName="<WorkspaceName>"
tableName="<TableName>"

# Update the table plan
az monitor log-analytics workspace table update \
  --resource-group "$resourceGroupName" \
  --workspace-name "$workspaceName" \
  --name "$tableName" \
  --plan Analytics

The following Azure PowerShell example uses the Update-AzOperationalInsightsTable cmdlet. It updates the table plan by using the Plan parameter, set to Analytics or Basic.

# Set variables
$resourceGroupName = "<ResourceGroupName>"
$workspaceName = "<WorkspaceName>"
$tableName = "<TableName>"

# Update the table plan
$updateAzOperationalInsightsTableParams = @{
    ResourceGroupName = $resourceGroupName
    WorkspaceName     = $workspaceName
    TableName         = $tableName
    Plan              = "Basic"
}

Update-AzOperationalInsightsTable @updateAzOperationalInsightsTableParams

The following REST example uses the Tables - Update REST API operation. It sets the table plan to Analytics, Basic, or Auxiliary.

PATCH https://management.azure.com/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{WorkspaceName}/tables/{TableName}?api-version={ApiVersion}
Authorization: Bearer {AccessToken}
Content-Type: application/json

{
  "properties": {
    "plan": "Auxiliary"
  }
}

Data continuity for table plan changes

Changing a table plan requires new access behavior to data ingested after the change. Data ingested before the change is preserved for its retention period. The change doesn't delete or move existing data. How you access the data ingested before the change depends on the table plan before the change.

Table plan change Data access behavior

Analytics to Auxiliary Data ingested during the Analytics plan before the table plan change is available in the interactive query experience. A single interactive query might get the following warning if it spans the date when Auxiliary / Lake data became available:

"message: Table '{TableName}' has Auxiliary / Lake data starting from {TimeDate}. Query spanning this date may return partial results. Please adjust your query time range to either before or after this date."

Auxiliary to Analytics Data ingested under the Auxiliary plan before the table plan change isn't available in the interactive query experience. To access the data ingested before the change, run a search job or use the search REST API. Data ingested after the change is fully available for interactive queries.

Table plan change	Data access behavior
Analytics to Auxiliary	Data ingested during the Analytics plan before the table plan change is available in the interactive query experience. A single interactive query might get the following warning if it spans the date when Auxiliary / Lake data became available: "message: Table '{TableName}' has Auxiliary / Lake data starting from {TimeDate}. Query spanning this date may return partial results. Please adjust your query time range to either before or after this date."
Auxiliary to Analytics	Data ingested under the Auxiliary plan before the table plan change isn't available in the interactive query experience. To access the data ingested before the change, run a search job or use the `search` REST API. Data ingested after the change is fully available for interactive queries.

Learn about managing data retention.

Feedback

Was this page helpful?

Last updated on 2026-07-27