Unable to query Azure Data Factory logs from Log Analytics – Unsupported tables like ADFSandboxActivityRun

Hi Stephen Lawrence Even though ADFSandboxActivityRun and similar tables appear in the Log Analytics Tables pane, they aren't actually queryable. These “sandbox” logs are tied to internal/debug activities in ADF and are not currently supported for KQL queries even when diagnostics are configured correctly with resource-specific mode.

Microsoft does list these tables in their official documentation but marks them as unsupported for basic log plans, meaning they may be visible but don’t ingest data in a way that allows querying.

Here’s the relevant Microsoft doc that confirms this: https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-logs/microsoft-datafactory-factories-logs

In the meantime, the tables that work reliably for most operational monitoring are:

• ActivityRuns, PipelineRuns, TriggerRuns

To check which tables are actually receiving data in your workspace, you can run:

union *
| where TimeGenerated > ago(1h)
| summarize count() by Type

This will show you which tables have active log ingestion.

If you really need sandbox-level logs for debugging or dev/testing, I’d recommend using ADF’s built-in monitoring view in the Azure portal or consider exporting logs via the REST API if needed.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Hi,

Thanks for your response. I’ve already configured diagnostic settings as per Microsoft guidance (including switching to "Resource-specific" mode) and enabled all standard ADF categories (PipelineRuns, ActivityRuns, TriggerRuns). These were confirmed as configured and active over a week ago.

I also validated the provider registration, log ingestion, and tried all supported queries — but no data was returned in any of the recommended tables. Microsoft documentation and your own Q&A forum now confirm that the tables where the data does show (e.g. ADFSandboxActivityRun) are not actually queryable and aren't supported in KQL despite being listed in the UI.

Could you please confirm if this is now a known limitation — and if so, what supported approach remains for monitoring failures like ForEach1 - Failed, given that the standard tables aren't being populated with the relevant failure details?

I'm happy to move to an alert-based setup or REST API approach if needed, but I’d like clarity first that this issue isn’t configuration-based at this point.

Stephen Lawrence Thanks again for the clarification. Given that you've already confirmed the standard ADF diagnostic categories are enabled and ingestion appears inactive across the expected tables (ActivityRuns, PipelineRuns, etc.), and considering Microsoft has acknowledged the sandbox tables are not queryable, we can confirm this is a known product limitation rather than a configuration issue on your side.

To move forward:

• If standard logs are expected but still not appearing, we recommend opening a support ticket with Azure Monitor/Log Analytics to investigate potential ingestion pipeline issues at the platform level.
• If you're specifically trying to capture failures like ForEach1 - Failed, these should typically appear under ActivityRuns. If they don’t, this might point to how certain activities (like nested ForEach or internal executions) are logged which unfortunately may fall under non-exposed logs at this time.

If alerts or REST API-based approaches are options you're open to, we'd be happy to help you set up filters for failed runs or error tracing via those methods.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Hi Venkat

Sadly I am on a developer subscription. Microsoft have changed the rules around raising tickets and for my subscription, I have to raise issues via this Q&A forum!

Can this be flagged internally with the Azure Monitor or Log Analytics teams for review?

I’d also appreciate guidance on alternative approaches using alerts or the REST API to reliably capture ADF pipeline failures (e.g., nested ForEach or activity errors).

Thanks again for your support — much appreciated.

Hello Stephen Lawrence,

Could you please share us the KQL query that you tried?