Azure Activity Log Profile in Use (Deprecated)

01 Sign in to Azure Management Console.

02 Navigate to Azure Monitor blade at https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview.

03 In the navigation panel, select Activity log to access the activity log available in your Azure cloud account.

04 From the Subscription filter box, select the Azure account subscription that you want to examine.

05 On the Activity log page, check for any Log Profiles configured for the selected subscription. If there is no Log Profile currently available, the selected Microsoft Azure subscription does not have a Log Profile configured.

06 Repeat step no. 4 and 5 for each subscription created in your Microsoft Azure cloud account.

01 Run monitor log-profiles list command (Windows/macOS/Linux) using custom query filters to list the name of the Log Profile created for the current Azure subscription:

az monitor log-profiles list --query '[*].name'

02 The command output should return the requested Log Profile identifier:

[]

03 Repeat step no. 1 and 2 for each subscription available in your Microsoft Azure cloud account.

01 Sign in to Azure Management Console.

02 Navigate to Azure Monitor blade at https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview.

03 In the navigation panel, select Activity log to access the activity log available within your Azure account.

04 From the Subscription filter box, select the Azure account subscription where you want to create the new Log Profile.

05 On the Activity log page, click on the purple banner to launch the Export activity log setup page (Azure Management Console legacy experience).

06 On the Diagnostic settings page, click Diagnostic settings. Diagnostic settings are used to configure the streaming export of the Azure subscription logs and metrics to the destination of your choice.

07 On the Export activity log panel, perform the following actions:

1. Select the appropriate subscription from the Subscription dropdown list.
2. From Regions dropdown list, select the regions with the events to export. It is recommended to select all regions to make sure that you export all the key events recorded, as the Azure activity log is a global (non-regional) log and so most events don’t have a region associated with them.
3. Select Export to a storage account if you want to write the activity log to an Azure storage account. Click Select a storage account and choose the Azure storage account that will store your log data. Enter the number of days that you need to retain your activity log data in the Retention day(s) box or use the slider control to set the appropriate retention period. A setting of 0 (zero) days retains the logs forever.
4. Select Export to an event hub if you want to write the activity log to an Azure Event Hub. Click Select a service bus namespace and choose the event hub namespace in which you would like an event hub to be created for streaming your activity log data.
5. Click Save to complete the setup process for your new Azure Log Profile and return to the Activity log blade.

08 Repeat steps no. 4 – 7 for each subscription created in your Microsoft Azure cloud account.

01 Run monitor log-profiles create command (Windows/macOS/Linux) to create a new Log Profile for the selected Microsoft Azure subscription in order to archive all Azure activity logs to a storage account or stream them to an Azure Event Hub. For example, the following command request creates an Azure Log Profile named "cc-log-profile", that writes Delete, Write and Action event-type activity logs to an Azure storage account identified by the ID "/subscriptions/abcdabcd-abcd-abcd-abcd-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcd1234abcd1234abcd", available within West Europe region (the command does not produce an output):

az monitor log-profiles create
	--name cc-log-profile
	--categories "Delete" "Write" "Action"
	--days 365
	--enabled true
	--location "westeurope"
	--locations "westeurope"
	--storage-account-id "/subscriptions/abcdabcd-abcd-abcd-abcd-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.Storage/storageAccounts/abcd1234abcd1234abcd"

02 Repeat step no. 1 for each subscription created in your Microsoft Azure cloud account.