2.2.4. Azure Activity Logs via Azure Policy and Diagnostic Settings
💡 First Principle: Azure doesn't send its logs anywhere until you tell it to. The instruction is a diagnostic setting, which routes a log stream to a destination such as a Log Analytics workspace. Configuring one subscription by hand is easy; guaranteeing that every current and future subscription is configured is a governance problem, which is what Azure Policy solves.
Two log families need separate settings:
- The Azure Activity log records subscription-level control-plane operations: who created, modified, or deleted resources, role assignments, policy events, and service health. It is configured with a diagnostic setting at the subscription and lands in the
AzureActivitytable. Security teams care because attacker actions in Azure (creating a VM, granting a role, disabling a setting) show up here. - Resource logs are emitted by individual resources (Key Vault access events, NSG flow events, Azure Firewall logs, storage access). Each resource needs its own diagnostic setting.
The Azure Activity connector in Sentinel uses Azure Policy to deploy those settings at scale. You assign the built-in policy that configures Azure Activity logs to stream to a specified Log Analytics workspace, usually at management group scope so every child subscription is covered. The policy uses the DeployIfNotExists effect: new subscriptions get the diagnostic setting automatically. Existing subscriptions don't change on their own; you run a remediation task to deploy the setting to them. The same pattern (a policy initiative plus remediation) is how many Sentinel connectors for Azure resource logs, such as Key Vault or Azure Firewall, achieve coverage at scale.
Permissions follow the work: assigning policies and running remediation needs a role such as Resource Policy Contributor or Owner at the assignment scope, and the policy's managed identity needs rights to create diagnostic settings and write to the workspace.
⚠️ Exam Trap: Assigning the policy does not fix existing subscriptions. "You assigned the policy, but logs from older subscriptions are missing" means a remediation task hasn't been run. And Activity log coverage doesn't include resource logs; Key Vault data-plane access needs its own diagnostic settings.
Reflection Question: Your company creates new Azure subscriptions weekly through automation. Why is a manually configured diagnostic setting per subscription a detection risk, and how does a management-group policy assignment change who is responsible for coverage?
