Activity log in Azure is a platform-level log that records every write operation (PUT, POST, DELETE) performed on Azure resources, answering “who, what, when, and where” for management actions. It is not a diagnostic log for resource internals; it tracks control-plane events like creating a VM, restarting a web app, or changing a network security group.
What the Activity Log Covers
The activity log is automatically enabled for every Azure subscription and retains data for 90 days. It includes entries for operations such as:
- Creating, updating, or deleting a resource (e.g., a storage account or a virtual machine)
- Starting or stopping a resource (e.g., deallocating a VM)
- Assigning or removing role-based access control (RBAC) permissions
- Creating or deleting a service principal or Azure AD application
- Policy and compliance events (e.g., a resource being marked non-compliant)
- Alerts triggered by Azure Monitor conditions
Each log entry contains fields like operation name, status, timestamp, caller (who initiated the action), correlation ID, and resource ID. The caller field shows the user principal name or service principal that performed the action, which is crucial for security auditing.
How to Access and Query the Activity Log
You can view the activity log in the Azure portal under Monitor > Activity log. The default view shows the last 24 hours, but you can filter by time range, resource group, operation, and event severity. For more advanced queries, you can use:
- Azure CLI:
az monitor activity-log list --resource-group myRG - PowerShell:
Get-AzLog -ResourceGroupName myRG - REST API:
GET /subscriptions/{subscriptionId}/providers/microsoft.insights/eventtypes/management/values
For example, to find who deleted a specific VM, you would filter by the resource ID of that VM and look for the operation “Microsoft.Compute/virtualMachines/delete”. The entry shows the caller’s email or service principal ID and the timestamp.
Exporting Activity Log Data
Because the activity log only keeps 90 days, you often need to export it for longer retention or analysis. You can stream the log to a Log Analytics workspace, an event hub, or a storage account via Diagnostic settings in Azure Monitor. This is a one-time setup per subscription.
Common export destinations and their uses:
- Log Analytics workspace: Enables complex KQL queries, alerts on specific events, and integration with other Azure Monitor data.
- Event Hub: For real-time streaming to third-party SIEM tools like Splunk or QRadar.
- Storage account: For long-term archival and compliance, often with lifecycle management policies.
Once in Log Analytics, the data is stored in the AzureActivity table. A simple query like AzureActivity | where OperationNameValue contains "delete" | order by TimeGenerated desc returns recent delete operations.
Common Problems and Misconceptions
One frequent confusion is between the activity log and resource diagnostic logs. The activity log is for control-plane actions (who did what), while diagnostic logs are for data-plane operations (what happened inside a resource, like requests to a storage account or queries to a SQL database).
Another issue: the activity log does not include read operations. If you need to track who accessed a blob or read a secret, you must enable resource-specific diagnostic logs (e.g., storage account logging or Azure Key Vault audit events).
Also, the 90-day retention is often misunderstood. If you export to a storage account, you control retention; if you don’t export, data older than 90 days is automatically deleted and cannot be recovered.
How to Choose the Right Export Method
Your choice depends on your goals:
- If you need to query history for troubleshooting, use Log Analytics.
- If you need real-time integration with an external SIEM, use Event Hub.
- If you only need to satisfy compliance or audit requirements, use a storage account with a retention policy.
You can also send the same activity log to multiple destinations simultaneously via diagnostic settings. For example, you might send to Log Analytics for daily monitoring and to a storage account for annual archival.
Costs of Activity Log Export
There is no charge for the activity log itself, but exporting it incurs costs based on the destination. For Log Analytics, you pay for data ingestion and retention (currently about $2.30 per GB for the first 5 GB per month, then per-GB pricing). For Event Hub, you pay for throughput units and data transfer. For storage accounts, you pay for storage capacity and operations.
To control costs, you can filter which categories are exported (e.g., only Administrative, not Alert or Policy) and set retention policies in Log Analytics to delete data after a certain period.
Activity Log vs. Azure AD Sign-in Logs
Another common comparison is with Azure AD sign-in logs. The activity log tracks management actions on Azure resources, while Azure AD sign-in logs track user authentication events. If you need to see who signed in and when, you use the Azure AD sign-in logs; if you need to see who created a VM, you use the activity log. Both are part of Azure Monitor and can be exported to Log Analytics for unified querying.
Frequently Asked Questions
Q: How long does Azure keep activity log data?
By default, 90 days. After that, data is purged unless you export it to a storage account, Log Analytics, or Event Hub.
Q: Can I get alerts when a specific activity log event occurs?
Yes. Create an activity log alert rule in Azure Monitor, specifying the operation name, resource, and condition (e.g., any delete operation on a VM).
Q: Does the activity log show read operations?
No. It only records write operations (create, update, delete) and some administrative actions like starting/stopping resources. For read access, you need resource-level diagnostic logs.
Q: How do I find who deleted a resource?
Go to the activity log, filter by the resource ID or resource group, and look for the delete operation. The “Caller” field will show the user or service principal that performed the deletion.
Q: Can I export the activity log to a third-party SIEM?
Yes, stream it to an Event Hub and then connect your SIEM to that hub. Most major SIEMs have built-in connectors for Azure Event Hubs.
Q: Is the activity log available for all Azure resources?
Yes, it is a subscription-level log that covers all resources in that subscription, including those in different resource groups.
Activity Log Template
Activity Log Query Template (KQL for Log Analytics)
| Field | Value |
|---|---|
| Time range | Last 24 hours |
| Operation | Microsoft.Compute/virtualMachines/write |
| Resource group | myResourceGroup |
| Caller | user@example.com |
Sample (fictional): AzureActivity | where OperationNameValue == "Microsoft.Compute/virtualMachines/write" and ResourceGroup == "myResourceGroup" and Caller == "user@example.com" | project TimeGenerated, Caller, OperationNameValue, ResourceId
For legal, tax, or compliance-specific auditing, consult a qualified professional to ensure your logging meets regulatory requirements.