I am setting up the production environment/resource group for a project. Azure constantly creates a resource group called DefaultResourceGroup-WEU and places a DefaultWorkspace-bfcb05a5-938f-4336-9e3c-a5963f10acb7-WEU log analytics workspace in it. I tried creating a analytics workspace myself hoping it would stop doing it but it doesnt work.
It clutters up the organisation I want to achieve. Besides it being annoying.
Does someone know why Azure does this and how I can alter this behavior?
If you are thinking why Azure is creating a resource group called DefaultResourceGroup-XXX where the XXX is related to your region and within that same resource group you have a DefaultWorkspace-SubscriptionID-XXX then it is most likely associated with Azure Security Center.
And yes we can change this behavior by logging on the Azure Security Center and in the Workspace configuration section, changing the default that is being configured, which is Use workspace(s) created by Security Center (default). Follow the steps mentioned below to solve your problem.
Azure Security Center (ASC) > (Management) Pricing & settings > Select Subscription.
ASC Settings > Auto provisioning > (Extensions) Log Analytics agent for Azure VMs > Edit configuration.
Workspace configuration.
There you will find two options
For more information read these Azure Security Center & log Analytics Workspaces blog and Configure auto provisioning for agents and extensions from Microsoft Defender for Cloud document.
