Activity Log All Regions (Deprecated)

01 Sign in to Azure Management Console.

02 Navigate to Azure Monitor blade at https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview.

03 In the navigation panel, select Activity log to access the activity log available in your Azure cloud account.

04 From the Subscription filter box, select the Azure account subscription that you want to examine.

05 On the Activity log page, click Export to Event Hub to access your Azure Log profile configuration settings. If there is no Log Profile currently available, follow the steps outlined in this conformity rule to create and configure one. If there is a Log Profile available, check the Regions dropdown list. If the Select All option from the Region dropdown list is not checked, the Log Profile created for the selected Azure subscription is not configured to export activities from all supported Azure regions/locations (including global), thus the configuration is not compliant.

06 Repeat step no. 4 and 5 for each subscription created in your Microsoft Azure cloud account.

01 Run account list-locations command (Windows/macOS/Linux) using custom query filters to get the number of regions supported by the Microsoft Azure cloud:

az account list-locations
	--query '[*].displayName' | grep -P '\w+' | wc -l

02 The command output should return the current number of Azure cloud supported regions (excluding global):

34

03 Run monitor log-profiles list command (Windows/macOS/Linux) using custom query filters to get the number of Azure cloud regions configured for your Azure Log Profile. Each Azure subscription has only one Log Profile. If there is no Log Profile currently available, follow the steps outlined in this conformity rule to create one:

az monitor log-profiles list
	--query '[*].locations' | grep -P '\w+' | wc -l

04 The command output should return the number of Azure regions configured for the selected Log Profile + 1 (i.e. global region):

5

05 Repeat steps no. 1 – 4 for each subscription available in your Microsoft Azure cloud account.

01 Sign in to Azure Management Console.

02 Navigate to Azure Monitor blade at https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview.

03 In the navigation panel, select Activity log to access the activity log available in your Azure cloud account.

04 From the Subscription filter box, select the Azure account subscription that you want to update.

05 On the Activity log page, click Export to Event Hub to access your Azure Log Profile configuration settings.

06 On the Export activity log panel, click on the Select All option from the Region dropdown list to configure the selected Azure Log Profile to export activities from all Azure supported regions/locations (including global region). Click Save to apply the configuration changes.

07 Repeat steps no. 4 – 6 for each subscription created in your Microsoft Azure cloud account.

01 Run monitor log-profiles list command (Windows/macOS/Linux) using custom query filters to get the name of the Log Profile available in the current Azure subscription. Each Microsoft Azure subscription has only one Log Profile:

az monitor log-profiles list
	--query '[*].name'

02 The command output should return the name of the requested Azure Log Profile:

[
  "cc-azure-log-profile"
]

03 Run monitor log-profiles update command (Windows/macOS/Linux) using the name of the Azure Log Profile returned at the previous step as identifier parameter to configure the selected Log Profile to capture activity logs for all Microsoft Azure supported regions (including global). To configure your Log Profile to include all supported regions, define a comma-separated list of regions for which you would like to collect Azure activity log events. You can view a list of all regions for your subscription using az account list-locations --query '[*].name' command. The following command request does not produce an output:

az monitor log-profiles update
	--name cc-azure-log-profile
	--set locations=["global","eastasia","southeastasia","centralus","eastus","eastus2","westus","northcentralus","southcentralus","northeurope","westeurope","japanwest","japaneast","brazilsouth","australiaeast","australiasoutheast","southindia","centralindia","westindia","canadacentral","canadaeast","uksouth","ukwest","westcentralus","westus2","koreacentral","koreasouth","francecentral","francesouth","australiacentral","australiacentral2","uaecentral","uaenorth","southafricanorth","southafricawest"]

04 Repeat steps no. 1 – 3 for each subscription created in your Microsoft Azure cloud account.