Skip to main content
Azure Activity Log Azure Activity Log is the subscription-level control-plane audit trail for Azure. It records management operations performed through Azure Resource Manager, such as create, update, and delete actions (PUT/POST/DELETE). Read-only GET calls are generally not logged in the Activity Log. The Activity Log captures key audit fields including:
  • the operation performed,
  • the caller who initiated it,
  • the timestamp,
  • the operation status and related metadata useful for auditing and troubleshooting.
Activity Log is enabled by default for every subscription and retains data for 90 days at no charge. To keep logs longer or centralize them for analysis, export Activity Logs to a Storage Account, a Log Analytics workspace, or an Event Hub.
Activity Log records control-plane events (actions against Azure resources). It does not capture guest OS, application, or diagnostic logs from inside VMs—those are collected via diagnostic settings and agents (for example, the Azure Monitor agent) and are separate from Activity Logs.
A slide titled "Azure Activity Log" showing a diagram of logging types across Application, Resource and Azure Infrastructure layers (Application Logs, Diagnostic Logs, Activity Logs). On the left are colored buttons listing related features: Subscription-Level Logging, Auditing, Retention and Querying Data.
Where Activity Log fits Think of Azure logging in three layers:
  • Application logs — application or guest OS logs produced by your code or services.
  • Diagnostic logs / guest metrics — host/VM and application diagnostics (often via agents or VM Insights).
  • Activity Log — Azure control-plane operations executed through Resource Manager (resource creation, updates, deletes, policy evaluations, service health events).
Activity Log only reflects actions on the Azure control plane (resource lifecycle, policy and service events). Events that occur solely inside a VM’s guest OS or within apps must be collected separately via diagnostic settings, agents, or application instrumentation. Viewing platform metrics and Activity Logs in the portal
  • Platform metrics for resources (for example, a VM’s CPU or network metrics) are available in the Azure portal blade for that resource under Monitoring > Metrics.
  • Activity Log entries for a resource are available in the same resource blade under Activity Log.
  • Some guest OS or application metrics (for example memory) require the Azure Monitor agent or VM Insights to be enabled before they appear in Metrics Explorer.
A Microsoft Azure portal Metrics page for the virtual machine "win-sql-access" showing a line chart of Average Percentage CPU and Available Memory Bytes over time. The graph shows a sudden drop then a stable trend, with current values around 3.46% CPU and ~5.4 GiB available memory.
Activity Log scope and filters Every resource blade includes an Activity Log scoped to that resource. To see the subscription-wide Activity Log, go to Monitor > Activity Log or Subscription > Activity Log. Use the time range and built-in filters to narrow results. Common Activity Log filters:
  • Subscription
  • Time range
  • Severity
  • Resource group / Resource
  • Event initiated by (user or service principal)
  • Operation name
  • Event category
  • Search keywords
Event categories help narrow the type of control-plane events you want to investigate. A quick reference: Example: filter by Event category “Administrative” and then use “Event initiated by” to find actions by a specific user or service principal.
Screenshot of the Microsoft Azure portal showing the Activity log for the "Kodekloud AZ-500 PoC3" subscription. A filter dropdown is open listing operation types (e.g., Read Domain Service) and recent activity entries are shown in the log.
Exporting Activity Logs for longer retention and analysis The portal allows you to download Activity Log data as CSV for the default 90-day window. For extended retention, correlation, or SIEM integration, configure a subscription-level diagnostic setting to send Activity Log categories to one or more destinations. Common export destinations: When you configure diagnostic settings for the Activity Log, you can choose which categories to export (Administrative, Security, ServiceHealth, etc.) and multiple destinations. Logs sent to a Log Analytics workspace adhere to that workspace’s retention policy.
A screenshot of the Microsoft Azure portal showing the "Diagnostic setting" configuration page with log categories listed on the left and destination details on the right. The Administrative, Security and ServiceHealth categories are checked and "Send to Log Analytics workspace" is enabled.
Quick example — Azure CLI: create a diagnostic setting that sends Activity Log to a Log Analytics workspace Note: replace the placeholders in backticks with your actual values.
Querying Activity Logs
  • Short-term/quick checks: use the Activity Log blade and its filters in the Azure portal.
  • Advanced or long-term analysis: export Activity Logs to a Log Analytics workspace and query with Kusto Query Language (KQL). Exported Activity Log records are typically stored in the AzureActivity table.
KQL example — find administrative operations by a specific user in the last 7 days:
Permissions and governance To view or configure Activity Log exports, you need appropriate Azure RBAC permissions at the subscription level. For diagnostic settings, roles such as Owner or Contributor (or a custom role with Microsoft.Insights/diagnosticSettings/* permissions) are required.
Retention and access considerations: the Activity Log default retention is 90 days. If you need longer retention for compliance, ensure you export logs to Storage or Log Analytics and verify access controls and retention policies for those destinations.
Summary
  • Azure Activity Log = subscription-level control-plane audit trail for Azure Resource Manager operations.
  • Activity Log is enabled by default and retained free for 90 days.
  • Use diagnostic settings to export Activity Logs to Storage Accounts (archive), Log Analytics (querying/alerts), or Event Hubs (SIEM/streaming).
  • Activity Log does not capture guest OS or application-level logs — use diagnostic logs and agents (Azure Monitor agent / VM Insights) for those.
Further reading and references

Watch Video