Activity Log — Who Did What on the Subscription

Azure Basics · Azure Monitor – Metrics, Logs, Alerts, Log Analytics, Network Watcher · Lesson 2 of 5

The Activity Log records management (control-plane) operations such as creating, updating and deleting resources; filter by time, severity and category; it keeps 90 days, so send it to Log Analytics or storage to keep it longer.

The Activity Log records control-plane operations on a subscription: who (caller), what (operation), when, on which resource, and the result (status). Examples: creating a VM, deleting an NSG, changing a role assignment.

Category	Examples
Administrative	Create/Update/Delete resource, role assignments
Service Health	Azure incidents affecting a region/service
Resource Health	A resource becoming Unavailable
Alert, Autoscale	Alerts firing, autoscale adding instances
Security, Policy, Recommendation	Defender for Cloud, Azure Policy, Advisor

flowchart LR
  OP["Portal / CLI / API<br/>create, update, delete"] --> AL[("Activity Log<br/>kept 90 days")]
  AL -- "diagnostic setting" --> LA["Log Analytics<br/>KQL, alerts"]
  AL --> SA["Storage account<br/>long-term archive"]
  AL --> EH["Event Hub<br/>SIEM"]

View it in the Portal, CLI, PowerShell or REST API; filter by management group, subscription, timespan, event severity and category; download CSV.
It is kept for 90 days. To keep it longer or query it with KQL, create a diagnostic setting sending it to Log Analytics, a storage account or an Event Hub.
It does not record the data plane (blob reads, SSH sign-ins to a VM) — those are resource logs or guest OS logs.

Traps: confusing the Activity Log with resource/diagnostic logs; by default the CLI only fetches the last 6 hours (--offset 6h) and at most 50 events (--max-events).

Command	Meaning
`az monitor activity-log list -g rg-devops-lab --offset 1h`	Events in the last hour
`az monitor activity-log list -g rg-devops-lab --offset 1d --status Failed`	Failed operations
`az monitor activity-log list --caller ops@example.com --offset 7d`	By caller

Querying the log with KQL

Once a diagnostic setting sends the Activity Log to a workspace, it lands in the AzureActivity table:

AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue endswith "DELETE" and ActivityStatusValue == "Success"
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup, _ResourceId
| order by TimeGenerated desc

Retention then follows the workspace setting, so you can keep events for a year or more.

Investigating a change

Filter by resource and time window to find the operation.
Read the caller (a user, service principal, or managed identity) and the correlation ID, which ties together all the sub-operations of one request, such as a template deployment.
Look at the JSON details for the request properties and any error message.
Use Change Analysis (the resourcechanges table in Azure Resource Graph) to see which properties changed, not only that a write happened.

Alerts on activity

An activity log alert fires on a matching event, for example "any Microsoft.Compute/virtualMachines/delete in subscription sub-prod" or "a role assignment was created". Service Health alerts use the same mechanism to tell you about incidents and planned maintenance in the regions and services you use.

What lives elsewhere

Question	Where to look
Who signed in to the tenant and from where	Entra ID sign-in logs
Who changed users, groups, or Entra roles	Entra ID audit logs
Who read a blob or queried a database	Resource logs of that service
What happened inside a VM	Guest OS logs (Syslog, Windows events) through the Azure Monitor Agent

Entra ID logs are tenant-level and need their own diagnostic setting in the Entra admin center to reach a workspace.