This document explains the traffic routing behavior and bandwidth requirements when using Azure Monitor Private Link Scope (AMPLS) with Log Analytics Workspace (LAW) and Application Insights.
/32 system routes)With AMPLS configured, all traffic to Application Insights and Log Analytics Workspace bypasses your Azure Firewall by design, even with a 0.0.0.0/0 User-Defined Route (UDR) pointing to Azure Firewall.
Root Cause: Azure’s routing behavior for Private Endpoints, where more specific system routes take precedence over User-Defined Routes (UDRs).
When you create a Private Endpoint for AMPLS, Azure automatically injects a /32 system route for that Private Endpoint’s IP address into your subnet’s route table.
Azure uses longest prefix matching to determine which route to use:
| Route Prefix | Specificity | Priority |
|---|---|---|
| /32 | Most specific | Highest (always wins) |
| /24 | More specific | High |
| /16 | Less specific | Medium |
| /8 | Less specific | Low |
| /0 (0.0.0.0/0) | Least specific | Lowest |
Priority Route Next Hop Type Next Hop IP
1 10.1.5.10/32 InterfaceEndpoint (Private Endpoint - System Route)
2 0.0.0.0/0 VirtualAppliance 10.0.0.4 (Firewall)
Result: Traffic destined for 10.1.5.10 (Private Endpoint) uses the /32 route and never evaluates the 0.0.0.0/0 route.
Key Principle: A /32 route (most specific) always wins over broader routes like /16, /8, or /0. System routes for Private Endpoints are /32 routes. Your default route 0.0.0.0/0 to the firewall is the least specific route possible.
WebApp / Application
↓ App Insights SDK sends telemetry
DNS Resolution: api.applicationinsights.azure.com → Private IP (e.g., 10.1.5.10)
↓
Private Endpoint (/32 system route - bypasses firewall)
↓
Azure Backbone (Private Link Service)
↓
Application Insights Resource
↓
Log Analytics Workspace (internal Azure Monitor routing)
↓
Data stored in LAW tables (AppTraces, AppRequests, AppDependencies, AppExceptions, etc.)
User (in VNet or connected via VPN/ExpressRoute)
↓ Opens Azure Portal or runs KQL query
DNS Resolution: <workspace-id>.ods.opinsights.azure.com → Private IP (e.g., 10.1.5.10)
↓
QUERY REQUEST flows to Private Endpoint
↓
QUERY REQUEST flows through Azure Backbone
↓
QUERY EXECUTED on Log Analytics Workspace
↓
QUERY RESULTS flow back through Azure Backbone
↓
QUERY RESULTS flow through Private Endpoint
↓
User receives data
Should you need to inspect AMPLS traffic through your firewall for compliance or security policies, you can force this, but it requires additional configuration.
az network vnet subnet update \
--name <PrivateEndpointSubnet> \
--resource-group <ResourceGroup> \
--vnet-name <VNetName> \
--disable-private-endpoint-network-policies false
az network route-table route create \
--resource-group <ResourceGroup> \
--route-table-name <RouteTableName> \
--name AMPLS-PE-Route \
--address-prefix 10.1.5.10/32 \
--next-hop-type VirtualAppliance \
--next-hop-ip-address <FirewallIP>
Required to maintain symmetric routing and ensure return traffic flows back through the firewall.
This section addresses the customer ask: “What bandwidth is required when a user executes Log Analytics queries?”
For Log Analytics queries (Portal or API), the network requirement is primarily a function of:
So instead of a single fixed “Mbps requirement”, planning typically uses:
Microsoft documents these Azure Monitor Logs Query API limits (these are important because they cap worst-case results returned to clients):
Implication for bandwidth: even if a user runs an extremely broad query, the returned data is bounded by the “max size of data returned” and record limits, which helps you plan an upper bound for bursts.
Since Microsoft’s docs provide hard query result limits but do not give a single “Mbps per user” number for Log Analytics querying, the most defensible planning approach is:
A simple sizing formula:
Sustained Mbps ≈ (AvgResultMB × QueriesPerMinute × ConcurrentUsers × 8) / 60 × (1 + overhead%)
Example (interactive troubleshooting):
Mbps ≈ (2 × 1 × 10 × 8) / 60 × 1.2 ≈ 3.2 Mbps sustained
To measure and trend usage, Microsoft provides the LAQueryLogs table reference and sample queries. (learn.microsoft.com)
Useful fields include:
ResponseRowCount (rows returned)ResponseDurationMsScannedGB (for some query types)Stats* fields indicating processing characteristics (learn.microsoft.com)Note: LAQueryLogs does not directly expose “bytes returned”, so many customers approximate bytes based on row counts or export actual response payload sizes from client-side tooling. The most accurate approach for network capacity is to combine LAQueryLogs (who/when/which query patterns) with Private Endpoint “Bytes In/Out” metrics.
Recommended for “true bandwidth” measurements because it reflects actual network transfer.
Microsoft reference:
(Keep or adapt the KQL queries you already have in this document.)
(Keep existing best practices; they directly reduce result payload size and therefore bandwidth.)
Below are official references you can share with the customer for bandwidth/capacity planning.
Q: Is there an official “Mbps per user” requirement for Log Analytics queries?
A: Microsoft documents hard limits (max records returned, max result size, runtime, throttling), but not a single fixed Mbps-per-user requirement. Bandwidth needs depend on result size, concurrency, and refresh frequency. Use the limits for upper bounds and use LAQueryLogs + Private Endpoint metrics to measure real usage. (learn.microsoft.com)
az network nic show-effective-route-table \
--resource-group <ResourceGroup> \
--name <NIC-Name> \
--output table
Look for /32 routes pointing to InterfaceEndpoint.
nslookup <workspace-id>.ods.opinsights.azure.com
Should return private IPs (10.x.x.x), not public IPs.
tracert <private-endpoint-ip>
Should show direct connection to Private Endpoint, not via firewall.
Test-NetConnection -ComputerName <private-endpoint-ip> -Port 443
┌─────────────────────────────────────────────────────────────────┐
│ AMPLS DATA FLOW - COMPLETE PICTURE │
└─────────────────────────────────────────────────────────────────┘
INGESTION:
WebApp → Private Endpoint (10.1.5.x) → Azure Backbone → App Insights → LAW
↑ /32 route Private Link
└─ Bypasses Firewall
QUERY/EGRESS (bandwidth driver = result size returned to user):
User → Private Endpoint (10.1.5.x) → Azure Backbone → LAW → Results
↑ /32 route Private Link
└─ Bypasses Firewall
MICROSOFT QUERY LIMITS (bounds for planning):
- Max rows returned: 500,000
- Max data returned: ~64 MB compressed (~100 MiB raw)
- Max runtime: 10 minutes
- Throttling: 200 req / 30 sec / user or client IP
WHAT IS BYPASSED:
❌ Azure Firewall (via /32 system route)
❌ Public Internet (stays on Azure backbone)
❌ UDR 0.0.0.0/0 (overridden by /32 route)