Using azapi to configure Intune platform logs / diagnostic settings to a log analytics workspace

[lableoel]

Description
I am trying to forward Intune logs to Azure Log Analytics Workspace with this terraform provider but cannot get it to work.
Basically:

_resource "azapi_resource" "this" {
schema_validation_enabled = false

type = "/diagnosticSettings@2017-04-01-preview"
parent_id = "/providers/microsoft.intune"
name = "testAPI1"
body = {"properties":{"logs":[{"category":"AuditLogs","categoryGroup":null,"enabled":true,"retentionPolicy":{"days":0,"enabled":false}},{"category":"OperationalLogs","categoryGroup":null,"enabled":false,"retentionPolicy":{"days":0,"enabled":false}},{"category":"DeviceComplianceOrg","categoryGroup":null,"enabled":false,"retentionPolicy":{"days":0,"enabled":false}},{"category":"Devices","categoryGroup":null,"enabled":false,"retentionPolicy":{"days":0,"enabled":false}},{"category":"Windows365AuditLogs","categoryGroup":null,"enabled":false,"retentionPolicy":{"days":0,"enabled":false}}],"metrics":[],"workspaceId":"/subscriptions/MySubscriptionID/resourceGroups/MyResourceName/providers/Microsoft.OperationalInsights/workspaces/myresource-LogAnalytics-TransverseMonitoring","logAnalyticsDestinationType":null}}
}_

Issue:
Return

creating/updating Resource: (ResourceId "/providers/microsoft.intune/providers//diagnosticSettings/testAPI1" / Api Version "2017-04-01-preview"): PUT
│ https://management.azure.com/providers/microsoft.intune/providers/diagnosticSettings/testAPI1
│ --------------------------------------------------------------------------------
│ RESPONSE 404: 404 Not Found
│ ERROR CODE: InvalidResourceNamespace
│ --------------------------------------------------------------------------------
│ {
│ "error": {
│ "code": "InvalidResourceNamespace",
│ "message": "The resource namespace 'diagnosticSettings' is invalid."
│ }
│ }
│ --------------------------------------------------------------------------------

Working case with powershell
#Connect-Azaccount
$tokenInfo = Get-AzAccessToken -ResourceUrl "https://management.azure.com"
$authHeader = @{
Authorization = "{0} {1}" -f $tokenInfo.Type, $tokenInfo.Token
ContentType = "application/json"
}

$subscriptionId = "My-Subscription-ID"

$url = "https://management.azure.com/providers/microsoft.intune/diagnosticSettings/testAPI?api-version=2017-04-01-preview"

$body = '{"properties":{"logs":[{"category":"AuditLogs","categoryGroup":null,"enabled":true,"retentionPolicy":{"days":0,"enabled":false}},{"category":"OperationalLogs","categoryGroup":null,"enabled":false,"retentionPolicy":{"days":0,"enabled":false}},{"category":"DeviceComplianceOrg","categoryGroup":null,"enabled":false,"retentionPolicy":{"days":0,"enabled":false}},{"category":"Devices","categoryGroup":null,"enabled":false,"retentionPolicy":{"days":0,"enabled":false}},{"category":"Windows365AuditLogs","categoryGroup":null,"enabled":false,"retentionPolicy":{"days":0,"enabled":false}}],"metrics":[],"workspaceId":"/subscriptions/My-Subscription-ID9/resourceGroups/myresource/providers/Microsoft.OperationalInsights/workspaces/MyResourceName-LogAnalytics-TransverseMonitoring","logAnalyticsDestinationType":null}}'

$diagParam = @{
URI = $url
Method = "PUT"
Headers = $authHeader
Body = $($body)
}

$diagnostics = Invoke-RestMethod @diagParam -ContentType "application/json"

$diagnostics

Environment/question
Has anyone tried this before ? what am I doing wrong ? can it be done ?

[ms-henglu]

Hi @lableoel ,

Thank you for taking time to report this issue.

It seems that the type value in your configuration is incorrect, it should be Microsoft.Intune/diagnosticSettings@2017-04-01-preview.

Here's an example, hope it could help you:

resource "azapi_resource" "diagnosticSetting" {
  type = "Microsoft.Intune/diagnosticSettings@2017-04-01-preview"
  name = "testAPI"
  body = {
    properties = {
      logs = [
        {
          category      = "AuditLogs"
          categoryGroup = null
          enabled       = true
          retentionPolicy = {
            days    = 0
            enabled = false
          }
        },
        {
          category      = "OperationalLogs"
          categoryGroup = null
          enabled       = false
          retentionPolicy = {
            days    = 0
            enabled = false
          }
        },
        {
          category      = "DeviceComplianceOrg"
          categoryGroup = null
          enabled       = false
          retentionPolicy = {
            days    = 0
            enabled = false
          }
        },
        {
          category      = "Devices"
          categoryGroup = null
          enabled       = false
          retentionPolicy = {
            days    = 0
            enabled = false
          }
        },
        {
          category      = "Windows365AuditLogs"
          categoryGroup = null
          enabled       = false
          retentionPolicy = {
            days    = 0
            enabled = false
          }
        }
      ]
      metrics                     = []
      workspaceId                 = "/subscriptions/My-Subscription-ID9/resourceGroups/myresource/providers/Microsoft.OperationalInsights/workspaces/MyResourceName-LogAnalytics-TransverseMonitoring"
      logAnalyticsDestinationType = null
    }
  }
}