Enable Logging for Azure Storage Blob Service

01 Sign in to the Azure Management Console.

02 Navigate to Azure Storage accounts blade at https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Storage%2FStorageAccounts.

03 On the Storage accounts page, select the subscription that you want to examine from the Subscription filter box.

04 Click on the name (link) of the Azure Storage account that you want to examine.

05 In the blade navigation panel, under Monitoring (classic), choose Diagnostic settings (classic) to access the diagnostics settings.

06 On the Diagnostic settings (classic) page, make sure that the Status is set to On. If the Status setting is set to Off, the diagnostics are disabled, therefore the logging configuration is not compliant and the Audit process ends here. If the Status is set to On, select the Blob properties tab and check the Logging configuration section (regardless of its version, 1.0 or 2.0). If Read, Write, and Delete are not selected, the storage logging is not enabled for the Azure Storage Blob service within the selected storage account settings.

07 Repeat steps no. 4 – 6 for each storage account available in the selected Azure subscription.

08 Repeat steps no. 3 – 7 for each subscription created in your Microsoft Azure cloud account.

01 Run storage account list command (Windows/macOS/Linux) with custom query filters to describe the identifier of each storage account available in the current Azure subscription:

az storage account list
  --query '[*].name'

02 The command output should return the requested storage account names:

[
  "abcd1234abcd1234abcd1234",
  "abcdabcdabcd123412341234"
]

03 Run storage logging show command (Windows/macOS/Linux) using the name of the storage account that you want to examine as the identifier parameter and custom query filters to describe the blob logging settings available for the selected storage account:

az storage logging show
  --services b
  --account-name abcd1234abcd1234abcd1234

04 The command output should return the requested configuration information:

{
  "blob": {
    "write": false,
    "read": false,
    "delete": false,
    "retentionPolicy": {
      "days": null,
      "enabled": false
    },
    "version": "1.0"
  }
}

05 Repeat steps no. 3 and 4 for each storage account available in the current Azure subscription.

06 Repeat steps no. 1 – 5 for each subscription available in your Microsoft Azure cloud account.

01 Sign in to the Azure Management Console.

02 Navigate to Azure Storage accounts blade at https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Storage%2FStorageAccounts.

03 On the Storage accounts page, select the subscription that you want to access from the Subscription filter box.

04 Click on the name of the Azure Storage account that you want to reconfigure.

05 In the blade navigation panel, under Monitoring (classic), choose Diagnostic settings (classic) to access the diagnostics settings.

06 On the Diagnostic settings (classic) page, perform the following operations:

1. Make sure that the Status is set to On to enable the feature.
2. Select the Blob properties tab.
3. Select the Read, Write, and Delete checkboxes to enable Azure Storage Blob logging for read, write, and delete requests.
4. (Optional) Select the Delete data checkbox and set a retention period required to retain the storage logs based on your requirements.
5. Choose Save to apply the configuration changes.

07 Repeat steps no. 4 – 6 for each storage account available in the current Azure subscription.

08 Repeat steps no. 3 – 7 for each subscription created in your Microsoft Azure cloud account.

01 Run storage logging update command (Windows/macOS/Linux) using the name of the storage account that you want to reconfigure as the identifier parameter, to update the logging configuration settings available for the selected storage account in order to enable Azure Storage Blob logging for read, write, and delete requests. (Optional) Use the --retention parameter to set a retention period for your log data (the command does not produce an output):

az storage logging update
  --account-name abcd1234abcd1234abcd1234
  --services b
  --log rwd
  --retention 90

02 Repeat step no. 1 for each storage account available within the current Azure subscription.

03 Repeat steps no. 1 and 2 for each subscription created in your Microsoft Azure cloud account.