Encryption Service Log Migration to Azure Monitor

Encryption Service deployments created before November 2026 use this API to send logs, so Azure may show a Health Advisory for the "nordpass-eec-workspace" workspace. Microsoft has deprecated the Azure Monitor HTTP Data Collector API and ended support.

The change only affects where Azure stores the logs. You don't need to redeploy the Encryption Service, and group provisioning keeps running while you make the change.

This article explains how to switch the Encryption Service logs on Azure to Azure Monitor.

Before you start

You need the Contributor or Owner role on the resource group where the Encryption Service is deployed.
The "Microsoft.Insights" resource provider must be registered on your Azure subscription. To check, go to "Subscriptions" > your subscription > "Resource providers" and search for "Microsoft.Insights". If its status is not "Registered", select it and then select "Register".

Here's what to do

How to switch Encryption service logs to Azure Monitor

Log in to Microsoft Azure.
Open the "Resource group" where you deployed the Encryption Service.
Open "nordpass-eec-env".
Under "Monitoring", select "Logging options".
Set "Logs destination" to "Azure Monitor", then select "Save".
Under "Monitoring", select "Diagnostic settings".

Note: "Diagnostic settings" appears only after you save the change in step 5. If you don't see it, refresh the page.
Select "Add diagnostic setting".
"Diagnostic setting name", enter "container-apps-to-log-analytics".
Under "Logs", select "Container App console logs" and "Container App system logs".
Under "Destination details", select "Send to Log Analytics workspace".
Select your subscription and the "nordpass-eec-workspace" workspace, then select "Save".

How to verify the log collection

Azure may take up to 90 minutes to start sending logs to Azure Monitor:

Go to the "Resource group" where you deployed the Encryption Service.
Open "nordpass-eec-workspace".
Select "Logs".
Run this query:
```
ContainerAppConsoleLogs | where TimeGenerated > ago(1h) | take 10
```
Note: If the query returns results, the logs are now sent to Azure Monitor. The Encryption Service status in the NordPass Admin Panel stays "Active" the whole time.

Additional tips

If you can't save the diagnostic setting, make sure the "Microsoft.Insights" resource provider is registered. If it is, ask your Azure administrator to give you the Contributor role on the resource group.
If "Diagnostic settings" doesn't appear in the menu, search for "Monitor" in the Azure portal and select "Diagnostic settings". Filter by the "Container Apps Environment" resource type and select "nordpass-eec-env".
If the query returns no results after 90 minutes, open "Diagnostic settings" again. Check that both log types are selected and that "nordpass-eec-workspace" is the destination.
To undo the change, go to "Logging options" and set "Logs destination" back to "Log Analytics" with the same workspace.