Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Control plane and data plane

Azure's split between managing resources (control plane, Azure Resource Manager) and using them (data plane: reading secrets, blobs, network traffic).

In Azure, the control plane is Azure Resource Manager: creating a storage account, assigning a role, running a command on a VM. The data plane is the resource's own interface: reading a Key Vault secret, downloading a blob, a TCP connection to a VM.

The distinction decides where evidence lives. Control-plane operations are in the Activity Log, on by default. Data-plane operations are in resource logs and flow logs, which are off until a diagnostic setting enables them. Microsoft documents the split in control plane and data plane operations.

Why it matters in an incident: see Azure log forensics limits.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.