Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Azure Activity Log

The subscription-level log of control-plane operations in Azure — who created, changed or deleted which resource, when and from where. Kept 90 days.

The Azure Activity Log records control-plane operations sent through Azure Resource Manager: resource writes and deletes, actions such as runCommand/action or listKeys/action, role assignments, policy and service health events. Each entry carries the caller, token claims, caller IP, status and a correlationId.

Azure keeps it for 90 days; a diagnostic setting can export it for longer. It does not record data-plane access such as secret reads or blob downloads. Tenant-level events (for example elevateAccess) live in a separate tenant-level log.

See how to export the Activity Log and Azure Activity Log analysis step by step.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.