You plan to audit an Azure SQL database named sql1. The audit destination must allow querying events with the Kusto query language and require minimal administrative effort. Which audit destination should you configure?

A Log Analytics workspace is the correct choice because it natively supports Kusto Query Language (KQL) for querying collected logs, including Azure SQL database audit events. This provides powerful analytical capabilities with minimal administrative overhead once configured. An event hub is designed for real-time data streaming and would require additional services (like Azure Stream Analytics or Azure Functions) to process and store data for querying, increasing complexity. A storage account can store audit logs, but querying them directly with KQL is not natively supported; you would typically need to export them to another service like Log Analytics or Azure Data Explorer for KQL analysis.