Seen in the Azure Activity Logs solution view.
Detail: Access to the subscription was lost. Ensure that the XXX subscription is in the XXX Azure Active Directory tenant. If the subscription is transferred to another tenant, there is no impact to the services, but information for the tenant could take up to an hour to propagate.
SoureComputerID: all zeros
OperationStatus = Failed
OperationCategroy = Azure Activity Log Collection
- OMS is attempting to reach a subscription that has been deleted or is expired
- The AAD tenant associated with the subscription has changed
Disconnect the "problem" subscription from the Azure Activity Logs via the Azure ARM Portal.
- Open the ARM Portal
- Go to Log Analytics -> [your workspace] -> Azure Activity Logs (under Workspace Data Sources)
- From the listing of subscriptions, select the one you wish to disconnect
- In the new blade, click "Disconnect" from the blade header
Remove the OMS Azure Activity Logs solution (also known as Activity Log Analytics) either via the OMS portal or the Azure ARM Portal. Then re-add the solution to your workspace.
- do NOT delete Log Analytics from the ARM portal. This is NOT a solution and will delete your OMS workspace
- Removing the Azure Activity Logs solution will NOT delete existing data. Once you re-add the solution all events will reappear