# Azure Monitor Audit

> Configure Azure Monitor and Activity Log for auditing. Set up diagnostic settings and log analytics. Use when auditing Azure activity.

- Skill: `majiayu000/azure-monitor-audit` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/azure-monitor-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/azure-monitor-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/azure-monitor-audit

---


# Azure Monitor Audit

Audit Azure activity with Monitor and Activity Logs.

## Diagnostic Settings

```bash
# Enable diagnostic settings
az monitor diagnostic-settings create \
  --name audit-logs \
  --resource /subscriptions/{sub}/resourceGroups/{rg}/providers/... \
  --logs '[{"category":"AuditEvent","enabled":true}]' \
  --workspace /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{workspace}
```

## Activity Log Export

```bash
# Export activity log to Log Analytics
az monitor diagnostic-settings subscription create \
  --name activity-log-export \
  --location global \
  --logs '[{"category":"Administrative","enabled":true},{"category":"Security","enabled":true}]' \
  --workspace /subscriptions/.../workspaces/audit-workspace
```

## Log Analytics Queries

```kusto
// Failed login attempts
AuditLogs
| where TimeGenerated > ago(24h)
| where ResultType != "0"
| project TimeGenerated, Identity, ResultDescription, IPAddress

// Administrative changes
AzureActivity
| where CategoryValue == "Administrative"
| where OperationNameValue contains "write" or OperationNameValue contains "delete"
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup
```

## Best Practices

- Centralize to Log Analytics
- Long-term archive to Storage
- Configure alerts
- Regular query reviews