`az monitor log-analytics query` fails with `CloudEndpointNotSetException` on custom clouds

[kamil-mrzyglod]

Describe the bug

Running az monitor log-analytics query against a custom cloud (i.e. any cloud other than AzureCloud) raises CloudEndpointNotSetException, making the command completely unusable on sovereign or local clouds.

I have logAnalyticsResourceId set in my cloud config:

{
  "endpoints": {
    "acrLoginServerEndpoint": "https://topaz.local.dev:8899",
    "activeDirectory": "https://topaz.local.dev:8899",
    "activeDirectoryDataLakeResourceId": null,
    "activeDirectoryGraphResourceId": "https://topaz.local.dev:8899",
    "activeDirectoryResourceId": "https://topaz.local.dev:8899",
    "appInsightsResourceId": null,
    "appInsightsTelemetryChannelResourceId": null,
    "appServiceResourceId": null,
    "attestationResourceId": null,
    "azmirrorStorageAccountResourceId": null,
    "batchResourceId": null,
    "gallery": null,
    "logAnalyticsResourceId": "https://api.loganalytics.topaz.local.dev:8899",
    "management": "https://management.core.windows.net/",
    "mediaResourceId": null,
    "microsoftGraphResourceId": "https://topaz.local.dev:8899",
    "ossrdbmsResourceId": null,
    "portal": null,
    "resourceManager": "https://topaz.local.dev:8899",
    "sqlManagement": null,
    "synapseAnalyticsResourceId": null,
    "vmImageAliasDoc": null
  },
  "isActive": true,
  "name": "Topaz",
  "profile": "latest",
  "suffixes": {
    "acrLoginServerEndpoint": ".cr.topaz.local.dev",
    "attestationEndpoint": null,
    "azureDatalakeAnalyticsCatalogAndJobEndpoint": null,
    "azureDatalakeStoreFileSystemEndpoint": null,
    "keyvaultDns": ".vault.topaz.local.dev",
    "mariadbServerEndpoint": null,
    "mhsmDns": null,
    "mysqlServerEndpoint": null,
    "postgresqlServerEndpoint": null,
    "sqlServerHostname": null,
    "storageEndpoint": "storage.topaz.local.dev",
    "storageSyncEndpoint": null,
    "synapseAnalyticsEndpoint": null
  }
}

Related command

az monitor log-analytics query -w {customerId} --analytics-query "CliTakeTable_CL | take 2"

Errors

The command fails with error code 1. The run with --debug:

 az monitor log-analytics query -w a38f2261-96b7-4528-86aa-a320de182494 --analytics-query "CliTakeTable_CL | take 2" --debug
cli.knack.cli: Command arguments: ['monitor', 'log-analytics', 'query', '-w', 'a38f2261-96b7-4528-86aa-a320de182494', '--analytics-query', 'CliTakeTable_CL | take 2', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x107fbdd00>, <function OutputProducer.on_global_arguments at 0x1081c8180>, <function CLIQuery.on_global_arguments at 0x1081ee520>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'monitor': ['azure.cli.command_modules.monitor', 'azext_loganalytics']
cli.azure.cli.core: Loading command modules...
cli.azure.cli.core: Loaded command modules in parallel:
cli.azure.cli.core: Name                  Load Time    Groups  Commands
cli.azure.cli.core: monitor                   0.343        24        71
cli.azure.cli.core: Total (1)                 0.343        24        71
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name                  Load Time    Groups  Commands  Directory
cli.azure.cli.core: log-analytics             0.003         2         1  /Users/kamil/.azure/cliextensions/log-analytics
cli.azure.cli.core: Total (1)                 0.003         2         1  
cli.azure.cli.core: Loaded 24 groups, 72 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command  : monitor log-analytics query
cli.azure.cli.core: Command table: monitor log-analytics query
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x10916ee80>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/Users/kamil/.azure/commands/2026-07-20.09-33-26.monitor_log-analytics_query.55399.log'.
az_command_data_logger: command args: monitor log-analytics query -w {} --analytics-query {} --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x1091b4fe0>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x1091b72e0>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x1091b74c0>, <function register_upcoming_breaking_change_info.<locals>.update_breaking_change_info at 0x1091b7560>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x1081c8220>, <function CLIQuery.handle_query_parameter at 0x1081ee5c0>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x1091b7380>]
az_command_data_logger: extension name: log-analytics
az_command_data_logger: extension version: 1.0.0b1
cli.azure.cli.core.auth.persistence: build_persistence: location='/Users/kamil/.azure/msal_token_cache.json', encrypt=False
cli.azure.cli.core.auth.binary_cache: load: /Users/kamil/.azure/msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://topaz.local.dev:8899/50717675-3E5E-4A1E-8CB5-C62D8BE8CA48
msal.authority: openid_config("https://topaz.local.dev:8899/50717675-3E5E-4A1E-8CB5-C62D8BE8CA48/v2.0/.well-known/openid-configuration") = {'authorization_endpoint': 'https://topaz.local.dev:8899/organizations/oauth2/v2.0/authorize', 'token_endpoint': 'https://topaz.local.dev:8899/organizations/oauth2/v2.0/token', 'jwks_uri': 'https://topaz.local.dev:8899/common/discovery/v2.0/keys', 'userinfo_endpoint': 'https://topaz.local.dev:8899/oidc/userinfo', 'end_session_endpoint': 'https://topaz.local.dev:8899/common/oauth2/v2.0/logout', 'device_authorization_endpoint': 'https://topaz.local.dev:8899/organizations/oauth2/v2.0/devicecode', 'response_types_supported': ['code', 'code id_token', 'id_token', 'token id_token', 'token'], 'response_modes_supported': ['query', 'fragment', 'form_post'], 'grant_types_supported': ['authorization_code', 'implicit', 'refresh_token', 'client_credentials', 'password'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'token_endpoint_auth_methods_supported': ['client_secret_post', 'client_secret_basic', 'private_key_jwt'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access', 'User.Read'], 'claims_supported': ['aud', 'iss', 'iat', 'nbf', 'exp', 'aio', 'appid', 'appidacr', 'email', 'family_name', 'given_name', 'ipaddr', 'name', 'oid', 'scp', 'sub', 'tid', 'unique_name', 'upn', 'ver']}
msal.application: Broker enabled? None
cli.azure.cli.core.azclierror: Traceback (most recent call last):
  File "/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/lib/python3.13/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
  File "/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/lib/python3.13/site-packages/azure/cli/core/commands/__init__.py", line 682, in execute
    raise ex
  File "/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/lib/python3.13/site-packages/azure/cli/core/commands/__init__.py", line 812, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
                   ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/lib/python3.13/site-packages/azure/cli/core/commands/__init__.py", line 781, in _run_job
    result = cmd_copy(params)
  File "/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/lib/python3.13/site-packages/azure/cli/core/aaz/_command.py", line 155, in __call__
    return self._handler(*args, **kwargs)
           ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/Users/kamil/.azure/cliextensions/log-analytics/azext_loganalytics/aaz/latest/monitor/log_analytics/_query.py", line 36, in _handler
    self._execute_operations()
    ~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/Users/kamil/.azure/cliextensions/log-analytics/azext_loganalytics/aaz/latest/monitor/log_analytics/_query.py", line 75, in _execute_operations
    self.QueryExecute(ctx=self.ctx)()
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/lib/python3.13/site-packages/azure/cli/core/aaz/_operation.py", line 37, in __init__
    self.client = ctx.get_http_client(self.CLIENT_TYPE)
                  ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/lib/python3.13/site-packages/azure/cli/core/aaz/_command_ctx.py", line 76, in get_http_client
    self._clients[client_type] = client_cls(self, credential=credential, **client_kwargs)
                                 ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/lib/python3.13/site-packages/azure/cli/core/aaz/_client.py", line 75, in __init__
    raise CloudEndpointNotSetException()
azure.cli.core.cloud.CloudEndpointNotSetException

cli.azure.cli.core.azclierror: 
az_command_data_logger: 
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x10916f100>]
az_command_data_logger: exit code: 1
cli.__main__: Command ran in 0.447 seconds (init: 0.060, invoke: 0.387)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4102 in cache file under /Users/kamil/.azure/telemetry/20260720093326310
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/bin/python /opt/homebrew/Cellar/azure-cli/2.84.0/libexec/lib/python3.13/site-packages/azure/cli/telemetry/__init__.py /Users/kamil/.azure /Users/kamil/.azure/telemetry/20260720093326310"
telemetry.process: Return from creating process 55407
telemetry.main: Finish creating telemetry upload process.

Issue script & Debug output

See above.

Expected behavior

The command uses the logAnalyticsResourceId endpoint from the cloud configuration as the base URL.

Environment Summary

azure-cli 2.84.0 *

core 2.84.0 *
telemetry 1.1.0

Extensions:
log-analytics 1.0.0b1

Dependencies:
msal 1.35.0b1
azure-mgmt-resource 24.0.0

Python location '/opt/homebrew/Cellar/azure-cli/2.84.0/libexec/bin/python'
Config directory '/Users/kamil/.azure'
Extensions directory '/Users/kamil/.azure/cliextensions'

Python (Darwin) 3.13.12 (main, Feb 3 2026, 17:53:27) [Clang 17.0.0 (clang-1700.6.3.2)]

Additional context

In src/log-analytics/azext_loganalytics/aaz/latest/_clients.py, the metadata index key is set to:

_CLOUD_HOST_METADATA_INDEX = "logAnalyticslogAnalyticsResourceId"

The prefix logAnalytics is duplicated — it should be:

_CLOUD_HOST_METADATA_INDEX = "logAnalyticsResourceId"

Because the key never matches anything in the cloud metadata, get_cloud_endpoint returns None. The fallback _CLOUD_HOST_TEMPLATES only contains AzureCloud, so all custom clouds receive None as the base URL, which raises CloudEndpointNotSetException.

[yonzhan]

Thank you for opening this issue, we will look into it.