The Azure Landing Zones (Enterprise-Scale) architecture provides prescriptive guidance coupled with Azure best practices, and it follows design principles across the critical design areas for organizations to define their Azure architecture
One area I highly recommend for customers with ExpressRoute is setting up Connection Monitor, previously call Network Performance Monitoring (NPM). One of the requirements for NPM was placing the Log Analytics Workspace (LAW) in the same subscription as the ER circuit (ref: https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-performance-monitor-expressroute#discover-expressroute-peering-connections)
Though Network Watcher/Connection Monitor doesn't call out this requirement, it still relies on the NPM solution to be added to the workspace.
In a recent ESLZ customer engagement, we configured Connection Monitor to use the management subscription's LAW and got telemetry data and such, but the topology views (via ExpressRoute peerings) were not rendering. It wasn't until we created a new LAW and placed it in the connectivity subscription did we get full functionality of Connection Monitor with ExpressRoute.
It appears we might need to rethink where the Log Analytics Workspace is homed if NPM is identified as a critical component for ExpressRoute and network monitoring
One area I highly recommend for customers with ExpressRoute is setting up Connection Monitor, previously call Network Performance Monitoring (NPM). One of the requirements for NPM was placing the Log Analytics Workspace (LAW) in the same subscription as the ER circuit (ref: https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-performance-monitor-expressroute#discover-expressroute-peering-connections)
Though Network Watcher/Connection Monitor doesn't call out this requirement, it still relies on the NPM solution to be added to the workspace.
In a recent ESLZ customer engagement, we configured Connection Monitor to use the management subscription's LAW and got telemetry data and such, but the topology views (via ExpressRoute peerings) were not rendering. It wasn't until we created a new LAW and placed it in the connectivity subscription did we get full functionality of Connection Monitor with ExpressRoute.
It appears we might need to rethink where the Log Analytics Workspace is homed if NPM is identified as a critical component for ExpressRoute and network monitoring