Add documentation for reducing Azure Log Analytics costs from CoE service account sign-in logs

[Copilot]

Organizations running CoE Starter Kit at scale experience high Azure Log Analytics costs from non-interactive sign-in logs generated by service accounts during inventory collection. The Power Platform Admin connector requires user-based authentication, generating thousands of authentication events daily.

Documentation Added

• ReducingAzureLogAnalyticsCosts.md - Comprehensive analysis covering:

  • Root cause: Power Platform Admin connector lacks Service Principal support for most operations
  • Five mitigation options evaluated (log exclusion, retention optimization, scan frequency reduction, Application Users, custom connectors)
  • Recommended approach: Azure-side log filtering via transformation rules
  • Implementation guides with KQL examples
  • Cost estimation scenarios and FAQ

• ISSUE_RESPONSE_LOG_ANALYTICS_COSTS.md - Quick reference template for responding to similar issues

• Documentation/README.md - Index for the new documentation directory

Recommended Solution

Exclude CoE service account logs from Azure Log Analytics collection using transformation rules:

SigninLogs
| where UserPrincipalName !in ("coe-service@contoso.com", "powerplatform-admin@contoso.com")

This approach:

• Requires no CoE Starter Kit modifications (preserves managed solution for easy updates)
• Maintains inventory scan frequency (data freshness unchanged)
• Reduces costs by up to 100% for this log category
• Simple Azure-side configuration

Alternative approaches (custom connectors, Application Users) either create unmanaged layers that complicate updates or provide only partial cost reduction.

Repository Changes

Updated main README.md to reference the new Documentation folder.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[CoE Starter Kit - QUESTION] High amount of CoE Service Account Non-Interactive login logs</issue_title>
<issue_description>### Does this question already exist in our backlog?

• I have checked and confirm this is a new question.

What is your question?

We have identified rather high Azure Log Analytics costs caused by a large volume of non‑interactive sign‑in logs generated by the CoE Starter Kit service accounts in our organization. We would like guidance on best‑practice approaches to reduce or avoid these logs-particularly whether the CoE kit can be run using service principals instead of user accounts, and how others typically handle this. What are our options?

Ideas

• We do not want to reduce frequency of inventory scan due to keep data up to data and we do not want to introduce managed layers. That makes our update process cumbersome. Right?
• Can you use the kit with Service Principal connections for the Dataverse queries/actions (sync templates) to reduce amount?

Open for discussion and suggestions, thanks!

What solution are you experiencing the issue with?

Core

What solution version are you using?

No response

What app or flow are you having the issue with?

No response

What method are you using to get inventory and telemetry?

Cloud flows</issue_description>

<agent_instructions>Analyze and troubleshoot the issue why High amount of CoE Service Account Non-Interactive login logs and provide the solution for this issue.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

Custom agent used: CoE Custom Agent
Specialized agent for triaging and fixing issues in the CoE Starter Kit. Always consult the official CoE docs and the team’s SharePoint notes first, then mine prior GitHub issues and the CoE Common Responses playbook.

• Fixes [CoE Starter Kit - QUESTION] High amount of CoE Service Account Non-Interactive login logs #10712

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[muditagarwal2308]

Approved

[harini-2-y]

Approved