How Many Azure Monitor Workspaces for Sentinel, App Insights and VM Insights?

AZ-305 By islever Editorial Last updated

Design solutions for logging and monitoring

Short answer

A All four capabilities (Network Insights, Application Insights, Sentinel and VM insights) can share one Azure Monitor Log Analytics workspace managed by a single team.

Question

You have an Azure subscription.
You plan to deploy a monitoring solution that will include the following:
• Azure Monitor Network Insights
• Application Insights
• Microsoft Sentinel
• VM insights
The monitoring solution will be managed by a single team.
What is the minimum number of Azure Monitor workspaces required?
  1. 1 Correct Answer
  2. 2
  3. 3
  4. 4

Key Takeaways

The question tests whether you know that these four services are solutions layered on top of the same Log Analytics workspace rather than four independent data stores; the trap is assuming each named monitoring service demands its own workspace.

Azure Monitor Network Insights, Application Insights, Microsoft Sentinel and VM insights are all capabilities that store their telemetry in an Azure Monitor Log Analytics workspace, so a single team can run them from one workspace. This page confirms that the minimum workspace count is 1 (A), not one workspace per solution.

Common mistake: The most common wrong answer is C (3), reasoning that Network Insights and Application Insights each need a dedicated workspace while Sentinel and VM insights share one — but none of the four requires an exclusive workspace.

Expert Analysis

Why the Answer Is Correct

Azure Monitor Network Insights, Application Insights, Microsoft Sentinel and VM insights are all consumers of the same underlying data platform: the Azure Monitor Log Analytics workspace. Each one is enabled as a feature or solution on a workspace, and a single workspace can host all of them simultaneously. Because the scenario explicitly states that one team manages the entire monitoring solution, there is no organisational driver — such as separate teams, access boundaries or regional data residency — that would force a split. Microsoft's own workspace design guidance treats the workspace count as a design choice driven by data ownership, geography and retention, and states the default is to use as few as possible. Multiple workspaces add query complexity, duplicated configuration and cross-workspace query cost, so the minimum of 1 (A) is also the recommended starting point.

Why the Other Options Are Wrong

B (2) and C (3) both rest on the false premise that certain services require an exclusive workspace. Network Insights is a curated view over network telemetry such as NSG flow logs and Connection Monitor data that lands in a workspace — it does not own a workspace. Application Insights, in its workspace-based model, is a component of a Log Analytics workspace and can absolutely share it with Microsoft Sentinel. Sentinel is a security layer enabled on a Log Analytics workspace, and it can coexist with VM insights, which just deploys the Azure Monitor Agent and DCRs writing to the same workspace. D (4) simply extends that misunderstanding to one workspace per service. Nothing in the question mentions compliance, sovereignty, chargeback or tenant separation, so the extra workspaces would be unjustified overhead.

Community Comment Notes

The learner consensus here is strongly for option A, and the reasoning matches the official model. NotMeAnyWay's popular answer lists each of the four services and points out they "can send their data to a Log Analytics workspace", describing the workspace as a unique environment for Azure Monitor log data. nuyu00 posted the Microsoft workspace-design article as supporting evidence, which is the right authority to cite. Arun_U argued for C, claiming Network Insights and Application Insights each "requires a separate workspace" — that claim is not supported by the product documentation. caos_96's short "Why not A?" captures the confusion the distractors create, and fmelendezcr reinforces the point that because a single team manages everything, one workspace satisfies the requirement.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When an AZ-305 question names several Azure Monitor services and asks for the minimum workspace count, default to one workspace unless the scenario introduces a real splitting factor: separate teams, data residency, access isolation, or differing retention/pricing tiers. Scan the stem for a phrase like "managed by a single team" — it is there precisely to rule out the multi-workspace distractors. Remember that Sentinel, Application Insights and VM insights are features enabled on a workspace, not workspaces themselves.

Frequently Asked Questions

Why can Microsoft Sentinel and Application Insights share one workspace?

Both are enabled on top of a Log Analytics workspace rather than owning one; Sentinel adds SIEM data and Application Insights adds app telemetry to the same workspace.

What would force more than one Azure Monitor workspace here?

Only real splitting factors: data residency or geography, separate access control between teams, or different retention and pricing tiers per data set.

More AZ-305 FAQ →

Discussion 32 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 32

  1. NotMeAnyWay 👍 26 Answered A
    A. 1 You only need a single Azure Monitor Log Analytics workspace for all these monitoring solutions. Here's why: - Azure Monitor Network Insights, Application Insights, Microsoft Sentinel, and VM insights, all of these components can send their data to a Log Analytics workspace. - The workspace is a unique environment for Azure Monitor log data. Each workspace has its own data repository and configuration, and data sources and solutions are configured to store their data in a workspace. Therefore, a single Azure Monitor Log Analytics workspace can be utilized to collect and analyze data from all the components of the monitoring solution. This will also enable a unified management and analysis of the collected data.
  2. nuyu00 👍 10 Answered A
    https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design
  3. Jay1111 👍 4
    A Minimum : 1 Ideal : 2 1 workspace for Azure Monitor Network Insights. This workspace will collect and store network telemetry data from your Azure resources. 1 workspace for Application Insights, Microsoft Sentinel, and VM insights. This workspace will collect and store application, security, and virtual machine telemetry data from your Azure resources. By doing this, you can: Improve performance. By separating the different types of telemetry data, you can optimize the performance of your queries. Improve security. By separating the different types of telemetry data, you can reduce the risk of unauthorized access. Improve compliance. By separating the different types of telemetry data, you can make it easier to comply with regulatory requirements.
  4. Arun_U 👍 4 Answered C
    The Correct answer is C Azure Monitor Network Insights requires a separate workspace. Application Insights requires a separate workspace. Microsoft Sentinel and VM insights can share a workspace.
  5. caos_96 👍 4
    Why not A?
Show 25 more comments
  1. fmelendezcr 👍 3
    Based on the information provided, the minimum number of Azure Monitor workspaces required is 1. The key points: Azure Monitor Network Insights, Application Insights, Microsoft Sentinel, and VM insights can all be enabled within a single Azure Monitor workspace. Azure Monitor workspaces allow you to organize and manage monitoring data, configurations, and analytics. Since a single team will be managing the monitoring solution, a single workspace is sufficient. Multiple workspaces are only needed if you want to divide management responsibilities. All the mentioned monitoring services can be integrated into the same workspace. For example, you can ingest network and application logs into Microsoft Sentinel enabled in that workspace. VM insights can also be configured for the VMs to send data to the same workspace. Application Insights and Network Insights are natively integrated into the workspace.
  2. Ibanga 👍 3 Answered A
    A. No doubt.
  3. marcellov 👍 2 Answered A
    You can use a single workspace for all your data collection. You can also create multiple workspaces based on requirements such as: The geographic location of the data. Access rights that define which users can access data. Configuration settings like pricing tiers and data retention. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview
  4. LearnICC 👍 2
    https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design#data-ownership If you require data segregation: Use a separate workspace for each data owner. If you don't require data segregation: Use a single workspace for all data owners.
  5. shaiketisalat 👍 2
    Today's exam question
  6. ArunS005 👍 2 Answered A
    Option A is correct.
  7. alx3000 👍 2 Answered A
    should be A
  8. MeisAdriano 👍 1 Answered A
    This question has no sense, depends by situations and strategies. From https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design 1) A single Log Analytics workspace might be sufficient for many environments that use Azure Monitor and Microsoft Sentinel. But many organizations will create multiple workspaces to optimize costs and better meet different business requirements. 2) Design strategy: Your design should always start with a single workspace to reduce the complexity of managing multiple workspaces and in querying data from them. 3) The decision whether to combine your operational data from Azure Monitor in the same workspace as security data from Microsoft Sentinel or separate each into their own workspace depends on your security requirements and the potential cost implications for your environment.
  9. Thanveer 👍 1 Answered A
    The minimum number of Azure Monitor workspaces required for your monitoring solution is A. A single Azure Monitor workspace can handle multiple monitoring solutions, including Azure Monitor Network Insights, Application Insights, Microsoft Sentinel, and VM insights. This approach simplifies management and reduces complexity, making it easier for your team to handle all monitoring tasks from a centralized location.
  10. panhit 👍 1 Answered A
    passed today with 711. all case study came from exam topic (7 questions). rest only 10-15 questions were from exam topic. rest had to associate with what i studied. Az 104 dump was good. i think for az 305 the questions have changed. so you can expect around 20-25 questions from here. this came in exam today
  11. xRiot007 👍 1
    Then ChatpGPT is wrong in this case. You only need 1 workspace for all youse sources. I would advise reading the documentation and watching the video in the link bellow to get a correct understanding on how workspaces are used. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design
  12. serget12 👍 1
    With workspace-based resources, Application Insights sends telemetry to a common Log Analytics workspace, providing full access to all the features of Log Analytics while keeping your application, infrastructure, and platform logs in a single consolidated location.
  13. 74a0299 👍 1 Answered C
    Use 3 workspaces minimum when combining Sentinel + App Insights + VM/Network Insights. DCR (Data Collection Rules) are key for sharing workspaces efficiently between VM/Network Insights. Do not mix Sentinel with Application Insights in the same workspace.
  14. xRiot007 👍 1
    Depending on how important the data collected is and how much, multiple workspaces can be created. None of these details are present in the question, so we will consider none. One workspace should suffice until proven otherwise.
  15. serget12 👍 1
    When you enable VM insights on a single virtual machine or virtual machine scale set by using the Azure portal, you can select an existing workspace or create a new one
  16. WeepingMaplte 👍 1
    A single Log Analytics workspace might be sufficient for many environments that use Azure Monitor and Microsoft Sentinel.
  17. Lazylinux 👍 1 Answered A
    I would go for A hence 1 https://learn.microsoft.com/en-us/azure/azure-monitor/logs/workspace-design
  18. 4d4a2de 👍 1 Answered A
    Only workspace works for all monitoring solutions.
  19. MSC_2022 👍 1
    Yes, I think it should be A
  20. ccamlin111 👍 1
    This is what chatGPT says.
  21. lumax007 👍 1 Answered A
    A.1 Only one workspace
  22. andersonslls 👍 1 Answered A
    I think it's A indeed.
  23. JoniSwitzerland 👍 1
    I agree... Why not A?
  24. 4d4a2de 👍 1
    *one workspace
  25. pmanglaviti 👍 1 Answered A
    Minimum is 1

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Network Watcher IP Flow Verify vs Traffic Analytics

S-grade

Which components handle AKS state, pub/sub, and traffic splitting?

S-grade

Which Azure Storage setup retains blobs immutably for five years?

S-grade

Which Azure Monitor Features Provide Synthetic Transaction Monitoring for App1?

S-grade

Practice All AZ-305 Questions

Access 95 questions with complete answers and detailed explanations.

View Full AZ-305 Practice Test →

← Back to AZ-305 Study Guide