Showing results for 
Search instead for 
Did you mean: 

From Azure Log Analytics to an alert dashboard in PowerApps

After reviewing the Azure Log Analytics connector and working a lot with Azure Log Analytics, I have chosen to create a concept to use Kusto queries and displaying the results on a dashboard in a power app. This concept has not been implemented in production and is merely an example of how to combine Azure connectors with Flow and PowerApps.

Design.pngWhen looking at the design, three big components are used:

>> PowerApps – dashboard – Trigger for the flows

>> Microsoft Flow – Connection between Azure Log Analytics workspace and the Power App.

>> The "Log Analytics" workspace that contains logs of Azure resources.


In this example, a virtual machine that points to a Log Analytics workspace and collects all of the performances and security parameters of the virtual machine.


Before building the power app and flows, homework needs to be done in Azure. In this case, all the connectors in Flow will use a service principal to connect to the Azure Tenant and use the lowest privilege access rules.


In the Azure Portal, go to Azure AD and select "App registrations" in this blade click "New registration". Creating an app registration for the Log Analytics access in  Azure.

Flow09-05.pngApp registrations


Give a name for the app application service principal name.


When the app registration has been performed a secret need to be created. Select and click "Certificates & secrets" and click "New client secret". Make note of the password that has been created.


The Client ID, Client Secret, and Tenant ID will be used to authenticate the Azure Log Analytics connector in Flow to the Azure tenant. When this has been completed the development will proceed towards the power app. 
For the API permissions for Log Analytics and the tenant, permissions need to set.

LogAnalytics_API.pngAPI permissions

For Log Analytics API, admin consent is required and need to be enabled.

Log Analytics workspace and Azure VM's that have diagnostics settings enabled. 

The power app contains a simple gallery that displays the result of each Kusto query. Using a control timer, that function as a trigger for the Flow to get the results from the Log Analytics workspace. The flow will be triggered as the timer starts, and the timer is starting automatically and restarts every time the refresh time runs out.

Two screens have been created to display alerts for high CPU levels and Windows Updates for the virtual machine. This is how the screens are looking in the power app editor:

Flow09-01.pngAlerts dashboardFlow09-02.pngWindows updates dashboard

Within the timer property value, "OnTimerStart" following code has been added:

  • ClearCollect(Alerts,LogAnalyticsCPU.Run()) >> Gallery will be connected to the collection "Alerts
  • ClearCollect(WindowsUpdates,'LogAnalyticsWU'.Run()) >> Gallery will be connected to the collection "Windows Updates" 

One of the Flows that will be triggered from out of the power app, is "Log Analytics CPU"

The Flow is triggered by the power app, the action "Run query and list results" from the Azure Log Analytics connector will run the Kusto query. 


Authentication of the Azure Log Analytics connector will be done by an app application service principal that has been created in one of the previous steps: Flow09-09.png

Entering the correct client ID, tenant ID and client secret and clicking "Create" will connect the action to the given tenant and subscription, resource group and log analytics workspace can be selected. 


In the next two steps a filter will select only the information that we need to send back to the power app. 
Because of the array, "Response HTTP" is used to send the information back towards the power app.
This is the JSON schema used to send the information:

    "items": {
        "properties": {
            "HostName": {
            "AvgCPU": {
        "required": [

The same flow has been used for Windows Updates, but with a different Kusto query. See flow below:


Screenshot of the Windows update result for the virtual machine:

2019-05-28 16_18_06-.gif

This will be the same for alerts when the CPU is higher than 75%.

Hope you Like & Share this article! Please ask any questions in the comments below!
Thanks for reading! 

About the Author
  • Experienced Consultant with a demonstrated history of working in the information technology and services industry. Skilled in Office 365, Azure, SharePoint Online, PowerShell, Nintex, K2, SharePoint Designer workflow automation, PowerApps, Microsoft Flow, PowerShell, Active Directory, Operating Systems, Networking, and JavaScript. Strong consulting professional with a Bachelor of Engineering (B.E.) focused in Information Technology from Mumbai University.
  • I am a Microsoft Business Applications MVP and a Senior Manager at EY. I am a technology enthusiast and problem solver. I work/speak/blog/Vlog on Microsoft technology, including Office 365, Power Apps, Power Automate, SharePoint, and Teams Etc. I am helping global clients on Power Platform adoption and empowering them with Power Platform possibilities, capabilities, and easiness. I am a leader of the Houston Power Platform User Group and Power Automate community superuser. I love traveling , exploring new places, and meeting people from different cultures.
  • Read more about me and my achievements at: MCT | SharePoint, Microsoft 365 and Power Platform Consultant | Contributor on SharePoint StackExchange, MSFT Techcommunity
  • Encodian Owner / Founder - Ex Microsoft Consulting Services - Architect / Developer - 20 years in SharePoint - PowerPlatform Fan
  • Founder of SKILLFUL SARDINE, a company focused on productivity and the Power Platform. You can find me on LinkedIn: and twitter I also write at, so if you want some Power Automate, SharePoint or Power Apps content I'm your guy 🙂
  • I am the Owner/Principal Architect at Don't Pa..Panic Consulting. I've been working in the information technology industry for over 30 years, and have played key roles in several enterprise SharePoint architectural design review, Intranet deployment, application development, and migration projects. I've been a Microsoft Most Valuable Professional (MVP) 15 consecutive years and am also a Microsoft Certified SharePoint Masters (MCSM) since 2013.
  • Big fan of Power Platform technologies and implemented many solutions.
  • Passionate #Programmer #SharePoint #SPFx #M365 #Power Platform| Microsoft MVP | SharePoint StackOverflow, Github, PnP contributor
  • Web site – Youtube channel -