Azure Activity Log and Microsoft Defender for Cloud: what to collect and review

Three kinds of logs

The Activity Log records control-plane operations on Azure resources: who created, changed, or deleted what, and when. Resource logs (diagnostic logs) record data-plane activity inside a resource, such as blob reads or Key Vault secret access, and must be enabled per resource. Entra ID sign-in and audit logs cover identity. Activity Log data is kept for 90 days by default; export it with a diagnostic setting to a Log Analytics workspace or storage account for longer retention.

Defender for Cloud

Defender for Cloud continuously assesses resources against the Microsoft cloud security benchmark and produces recommendations grouped into a secure score. The enhanced Defender plans add threat detection for servers, storage, Key Vault, containers, and more, producing security alerts.

Treat recommendations as a prioritized backlog. Fix high-impact controls first, such as MFA, exposed management ports, and missing endpoint protection, and use exemptions with a reason instead of ignoring noise.

Lab: who deleted that resource?

In a sandbox subscription, create and then delete a resource group. Query the Activity Log from the CLI for delete operations, and read the caller, timestamp, and operation name. Then in Log Analytics, run the KQL query to see the same events once the diagnostic setting is in place.

az monitor activity-log list --offset 1d \
  --query "[?contains(operationName.value,'delete')].{when:eventTimestamp,who:caller,op:operationName.value,status:status.value}" -o table

AzureActivity
| where OperationNameValue endswith "DELETE"
| project TimeGenerated, Caller, OperationNameValue, ResourceGroup, ActivityStatusValue

Useful alerts

Alert on role assignment writes, policy assignment deletions, diagnostic setting deletions (an attacker covering tracks), network security group rules opening management ports, and Key Vault access policy changes.