Have you had to hunt for information in the Azure Activity Log?
A better logging setup makes this a lot easier to track down.
Published September 8, 2026
Tags: bicep, logging, diagnostic-setting, activity-log
Where did this resource come from? Who changed this setting? Why did this happen?
That’s usually where I end up in the Azure Activity Log. Something changed, and now I need to figure out what moved, who moved it, and roughly when it happened. The activity log will not tell you the whole story, but it does give you the change and the person behind it, which is enough to start narrowing things down. The annoying part is that it often takes longer than the portal makes it sound like it should.
I usually end up with one centralized App Insights and Log Analytics setup per environment, like dev, test, and prod. That gives you the whole picture instead of a pile of disconnected errors that all look unrelated until they don’t. If you are already deploying with infrastructure as code and pushing diagnostic settings everywhere, this fits right in. The nice part is that you can also send the subscription activity log into the same place, which makes the “who changed this?” question a lot easier to answer.
When I dug in further, I found that subscription diagnostic settings are the newer path in Azure. There are older activity log solutions out there, and if you are still using one of those, it is worth moving off it and using the current setup instead. Here are the Microsoft docs if you want the full details: https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log?tabs=portal-1%2Clog-analytics%2Cportal-2#export-activity-log
One thing to keep in mind is that activity logs only stick around for 90 days by default. Sending them to Log Analytics lets you keep them under the same retention rules as the rest of your logs, and in some cases you may want to keep them even longer. If that matters for your environment, it is worth planning for it up front.
The question I get most often is who created a resource, and this is exactly the kind of thing that helps answer it: https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log?tabs=portal-1%2Clog-analytics%2Cportal-2#identify-resource-creation
The docs also walk through how to query for events on a resource group or a single resource. https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log?tabs=portal-1%2Clog-analytics%2Cportal-2#list-activity-log-events-for-a-resource-group That is where Kusto starts to be useful.
If you want a quick view of the recent change trail, this is a handy starting point:
AzureActivity
| where CategoryValue == "Administrative"
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup, ResourceProviderValue, ActivityStatusValue
| order by TimeGenerated desc