Why this matters
Azure does not have one audit log. It has several, each with its own switch, its own default retention and its own place to send data. The three that matter most are the Activity Log, resource logs and the Microsoft Entra ID logs. Turning on one does not turn on the others.
The Activity Log is already running. It records management operations at subscription scope: who created the resource group, who changed a role assignment, who deleted the virtual machine. Azure keeps it for 90 days and then drops it. If you never export it, every question older than that window goes unanswered.
Resource logs are off until you configure a diagnostic setting on the resource itself. Blob reads, Key Vault secret reads, SQL queries and network flow records sit in this group. Without them you can prove a firewall rule changed but not who pulled data through it.
Entra ID keeps its own set: sign-ins, directory audit changes and risk events. These live in the tenant, not in the subscription Activity Log, and need a separate export. That split is usually where teams discover a gap, often during an incident.
Before you start
Choose your destinations first. A Log Analytics workspace gives you querying and alerting, a storage account gives cheap long term keeping, and an event hub feeds a SIEM. One diagnostic setting can send to more than one. Pick the workspace design before you click anything: a central workspace per environment is easier to query and easier to lock down than a workspace per team.
Check permissions. Monitoring Contributor on the subscription covers the Activity Log and resource settings. Entra ID diagnostic settings need a tenant level role such as Global Administrator or Security Administrator. If logs go to a workspace in another subscription, the person enabling the setting needs rights on both sides.
Understand the volume before you turn everything on. Storage read logs and firewall logs produce far more data than the Activity Log. Send specific categories instead of picking All logs, and consider the Basic logs plan for high volume tables you rarely search. Basic rows are cheaper to keep but only answer simple queries.
Make a short inventory: subscriptions, resource types, who will read the output and which resources are regulated or customer facing. Those answers set your retention period and decide whether you need a second, immutable copy.
How to do it
Work outward: subscription first, then resources, then the directory, then alerting. That order means the trail exists before you start changing things, so anything you break during setup gets recorded.
For more than a handful of subscriptions, do not click through the portal. Azure Policy can create diagnostic settings for you with a deployIfNotExists effect, and the built-in initiatives already cover the Activity Log and common resource types. Assign the policy at a management group so new subscriptions inherit it automatically.
The command line is worth scripting. The az monitor diagnostic-settings create command takes a workspace id and a category list, and it is repeatable and reviewable, which matters when someone asks later how the audit trail was configured.
Once the settings are live, add alerts on the operations you would want to hear about at 2am: role assignment changes, key vault deletion, network security group rule changes and deletion of a diagnostic setting.
- Create or pick a Log Analytics workspace. Create the workspace in the region your team already uses for monitoring, or reuse an existing central one. Note its resource id, because every diagnostic setting needs it. Give it a clear name that includes the environment.
- Export the Activity Log at subscription scope. Open the subscription, choose Activity log, then Export Activity logs, and add a diagnostic setting. Tick the categories you want, at minimum Administrative, Security, Policy and ServiceHealth, and select the workspace, a storage account or both.
- Turn on resource diagnostic settings. Open each resource, go to Diagnostic settings and add a setting that sends the log categories you need to the same workspace. Start with the resources that hold sensitive data: Key Vault, storage accounts, SQL servers and application gateways.
- Capture Microsoft Entra ID logs. In the Entra admin center, open Diagnostic settings under Monitoring and send SignInLogs, AuditLogs and the risk categories to your workspace. This export is separate from the subscription Activity Log and is often missed.
- Add the data plane categories you actually need. For storage accounts, choose read, write and delete categories only if you need them, since they are the loudest tables. For Key Vault, enable the audit event category so secret and certificate access is recorded.
- Set retention and an immutable archive. Set table retention in the workspace to match your policy instead of leaving the default. If you need a tamper resistant copy, send the same categories to a storage account with an immutable blob policy and a lifecycle rule.
- Create alerts for sensitive operations. Build alert rules on role assignment changes, key vault deletion, network security group rule changes and deletion of a diagnostic setting. Send them to a channel someone actually watches.
- Roll out with Azure Policy and document it. Assign a deployIfNotExists policy at management group scope so new subscriptions and resources get the same settings. Write down the workspace name, the categories enabled and the alert owner in your runbook.
How to check it worked
Open the subscription, go to Activity log, then Export Activity logs. The blade lists your diagnostic settings by name and destination. A setting with a red status or an empty destination means the export is broken.
Query the workspace. Open Logs and run a simple query such as AzureActivity with a one hour time filter. For directory data the tables are SigninLogs and AuditLogs. Empty results usually mean the wrong time range, the wrong table name, or a destination workspace id that does not match where you are looking.
Generate an event on purpose. Create a resource group, change a tag, delete the group. Wait a few minutes and search for it. Activity Log entries normally arrive quickly, some resource categories take longer. Ingestion delay is normal, silence is not.
Check for gaps weekly during the first month. Grouping record counts by hour shows whether data arrives steadily, and it catches a policy assignment that quietly failed on one subscription. Test one alert rule against a harmless operation so you know the notification path works before you need it.
Mistakes to avoid
Treating the Activity Log as the whole audit trail. It covers the control plane only. Reads and writes inside a storage account or a database need their own diagnostic settings, and those are the entries an investigator will ask for.
Enabling it on one subscription and assuming the rest is covered. Set the policy at management group scope, then check each subscription for a setting that actually points at a live workspace rather than a deleted one.
Leaving the log store open. The workspace is a security asset: keep Log Analytics Reader narrow, add a delete lock to the workspace, and send an immutable copy to storage if you have a keeping requirement. Deleting a diagnostic setting is itself an Activity Log event, so alert on that operation.
Sending everything to the analytics tier and never revisiting it. You pay to keep rows nobody queries. Review the table list quarterly and move low value, high volume tables to the Basic plan. And name an owner, because logs nobody reads are just storage.
Frequently asked questions
How long does Azure keep Activity Log data by default?
The subscription Activity Log keeps events for 90 days and then discards them. Anything you need to keep longer has to be exported to a workspace, a storage account or an event hub. Entra ID sign-in logs have a shorter default window on the free tier, so export them if you need history.
What is the difference between the Activity Log and resource logs in Azure?
The Activity Log records control plane operations such as creating, changing or deleting a resource. Resource logs record data plane activity such as blob reads or secret access, and they stay off until you add a diagnostic setting. You generally need both for a useful audit trail.
Can I enable diagnostic settings for every resource at once?
Not with a single switch, but Azure Policy can do it. A policy with a deployIfNotExists effect creates a diagnostic setting on each matching resource and can be assigned at management group scope. Check afterward that each setting points at a workspace that still exists.
Does exporting Azure logs cost money?
The Activity Log itself is free to read inside its default retention window. You pay for what you send to Log Analytics or storage, based on volume and how long you keep it. Filtering categories and using the Basic logs plan for high volume tables keeps that predictable, and Cloudverg's Cloud security review at $6,500 covers logging and alerting checks if you want an outside set of eyes.