Automatic corrections for Log Analytics workspace ARM property placement

Domain: monitoring

---

Check	Description
TFM-LA-001	Move disableLocalAuth from inside features block to properties root

---

Move disableLocalAuth from inside features block to properties root

Rationale: ARM silently drops disableLocalAuth if nested inside properties.features. The property must be a direct child of properties for Log Analytics workspaces.
Agents: terraform-agent, bicep-agent

• Microsoft.OperationalInsights/workspaces

Type: Regex
Search: '(features\s*=\s*\{[^}]*?)(\s*disableLocalAuth\s*=\s*\w+\s*\n?)([^}]*\})'
Replace: '\1\3'

---