Skip to content
Community Question

How can Azure Activity Logs help administrators investigate changes made to cloud resources?

Share knowledge. Learn from experts. Build together.

Question

When an Azure resource changes unexpectedly, administrators need to determine what changed, who initiated it, when it happened and whether the operation succeeded or failed. This discussion explores how Azure Activity Log records control-plane operations and can help investigate events such as resource creation, configuration changes, deletions and permission-related operations. It also examines filtering, querying, retention considerations, alerts and integration with broader monitoring and security workflows. A practical topic for Azure administrators, DevOps engineers, developers and cloud professionals responsible for production environments.
68 Views Community Discussion

Answers

Azure Activity Log is an important troubleshooting and governance tool because it records subscription-level control-plane operations performed against Azure resources. Administrators can investigate operations such as resource creation, modification, deletion, deployments, and RBAC changes.

During an incident, an administrator can filter events by resource, operation, time range, caller, status, or resource group and inspect the event's JSON details. Activity Log entries can help establish who initiated an operation, what operation occurred, when it happened, and whether it succeeded or failed.

For deeper investigation, Change History can show resource changes associated with an operation. Administrators should also understand the distinction between control-plane Activity Logs and resource/data-plane logs; Activity Log does not normally capture operations such as reading a secret from Key Vault.

By default, Activity Log data is retained for 90 days, so organisations requiring longer audit or compliance retention should export it to an appropriate destination such as Log Analytics.

Azure Activity Log is an important troubleshooting and governance tool because it records subscription-level control-plane operations performed against Azure resources. Administrators can investigate operations such as resource creation, modification, deletion, deployments, and RBAC changes.

During an incident, an administrator can filter events by resource, operation, time range, caller, status, or resource group and inspect the event's JSON details. Activity Log entries can help establish who initiated an operation, what operation occurred, when it happened, and whether it succeeded or failed.

For deeper investigation, Change History can show resource changes associated with an operation. Administrators should also understand the distinction between control-plane Activity Logs and resource/data-plane logs; Activity Log does not normally capture operations such as reading a secret from Key Vault.

By default, Activity Log data is retained for 90 days, so organisations requiring longer audit or compliance retention should export it to an appropriate destination such as Log Analytics.

Your Answer

Offerings Training Reviews
Connect