How do you set up logging and an audit trail in Azure?

To build an audit trail in Azure, export the activity log from every subscription, turn on resource logs with diagnostic settings for the services that hold data, send both to a Log Analytics workspace and immutable storage, and set retention longer than the 90 days Azure keeps by default.

What does Azure log without you doing anything?

The activity log. Microsoft's docs describe it as a record of management, or control plane, operations: creating a virtual machine, changing a key vault access policy, a deployment error. Entries are collected by default, and you cannot change or delete them. It typically does not capture read operations. Events usually show up for analysis within 3 to 20 minutes.

Azure retains these events for 90 days and then deletes them. One reason to keep them longer: the docs say the activity log is the only place that stores who created a resource.

What does it not log?

Resource logs. These capture data plane operations, such as getting a secret from a key vault or sending a request to a database. They are not collected by default. You need a diagnostic setting per resource.

A constructed example: someone reads every secret out of a key vault. The activity log shows nothing about the reads. Only a resource log with the right category turned on records it.

How do diagnostic settings work?

Each setting picks the data to collect and the destinations. Destinations are a Log Analytics workspace, a storage account, Event Hubs for streaming to external tools, or partner solutions. Points from the docs:

• Each resource can have up to five diagnostic settings, and one setting holds at most one destination of each type.
• Destinations must exist first. Regional storage and Event Hubs must be in the same region as the resource.
• Storage can be kept indefinitely. Microsoft suggests immutable storage to prevent modification.
• You can use category groups: allLogs, and audit for logs that record customer interactions with data or settings.
• Data should flow within 90 minutes of creating a setting. If nothing arrives in 24 hours, something is wrong.

A warning in the docs: delete diagnostic settings when you delete or rename a resource, or a recreated resource may inherit them.

For the activity log, use a subscription scope setting in the CLI. Microsoft says PowerShell cmdlets cannot create it; use a template instead. Management group settings capture events for groups below them, so a setting at the top avoids missing events, and duplicates are possible if lower levels also have one.

How long can you keep logs?

In a Log Analytics workspace you can keep activity log data for up to 12 years, and charges apply only to the period past 90 days. There are no ingestion charges for activity logs. Resource logs do cost money by volume, so collect only the categories you need.

What to do

1. List subscriptions and put an activity log diagnostic setting on each, or on the top management group.
2. Send the activity log to a Log Analytics workspace and to storage with an immutability policy.
3. Pick the services that hold sensitive data (key vaults, databases, storage) and enable the audit category group for them.
4. Decide retention by what your auditors and regulators ask for and set it explicitly.
5. Protect the destination: restrict who can delete or alter it with role based access control.
6. Alert on a few high risk activity events, such as role assignment changes and policy changes.
7. Clean up diagnostic settings when you retire resources.
8. Test quarterly: perform a known action and find it in the logs.

Safeguard's compliance automation can help collect and organize evidence against frameworks, but it does not replace turning these logs on.

Quick check

Sources

• Azure Monitor: activity log (fetched 18 October 2026)
• Azure Monitor: diagnostic settings (fetched 18 October 2026)

Last reviewed: 18 October 2026.