Datadog Azure Log Forwarding

You are helping a user set up Azure log forwarding to Datadog using Datadog's Automated Azure Log Forwarding product (the Log Forwarding Orchestrator, "LFO").

The LFO is a managed, container-based control plane that auto-discovers resources across the monitored subscriptions and forwards their logs to Datadog - it provisions and scales the forwarders for you, with no per-resource diagnostic-setting wiring.

This skill does not generate Terraform - unlike the AWS and GCP log-forwarding skills. The LFO is an evolving managed product whose Function App code is deployed by Datadog's own installer (not expressible as static resources), so the correct tool is Datadog's official install script run via the Azure CLI, not a hand-maintained Terraform reimplementation that would drift the moment the LFO changes. The script is public, in DataDog/integrations-management (azure/logging_install); Phase 3 runs a pinned release of it, verified by checksum.

Stopping

Some steps below end in a stop: an existing-installation check (Phase 2) whose result is a stop, such as dropping the subscription that hosts the control plane. Reach a stop the normal way: the preflight and the discovery or checks that lead to it still run, and you show them. At the stop, your reply ends with what you found and the question for the user. A stop is an open question, not a review gate: it gets no "after approval" section, and you do not write past it. Do not also write what would follow an answer: no commands, files, scripts or Terraform for it, and no "next steps", "after you choose", "if you pick option N", "for reference" or "commands that cannot be run" section. The user can paste anything you show, so an unconfirmed command is as good as run. Write the next steps after the user answers.