---
title: "Azure Audit"
slug: "azure-audit"
updated: 2025-10-30T18:41:55Z
published: 2025-10-30T18:41:55Z
canonical: "docs.databee.buzz/azure-audit"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Audit

Azure Compute Services are the core set of cloud computing services that allow you to deploy and manage workloads on Microsoft Azure. These services provide the infrastructure, tools, and platforms for computing and storage needs.

For detailed information, please refer to the [Microsoft’s official documentation](https://learn.microsoft.com/en-us/azure/security/fundamentals/log-audit)[.](https://learn.microsoft.com/en-us/azure/security/fundamentals/log-audit)

**Integration Method:** Azure Blob **Tables:** Group Management (3006), Entity Management (3004), Authorize Session (3003), Account Change (3001), User Access Management (3005)

| **Event** | **Description** |
| --- | --- |
| User Management | List of activities that log changes to user accounts like create, update, delete users, license assignments, password resets. |
| Device | List of activities that track changes to device properties and templates for managed devices. |
| Application Management | List of activities that capture application changes such as app registrations, updates, deletions, and service principal modifications. |
| Role Management | List of activities that track creation, updates, and deletions of roles and role assignments. |
| Group Management | List of activities that log group operations including creation, updates, and membership changes. |
| Authorization | List of activities that record permission grants, consents, and other authorization-related actions. |
| Provisioning Management | List of activities that track provisioning operations from identity providers or external services. |
| Contact | List of activities that log creation, updates, and deletions of contact directory objects. |
| Administrative Unit | List of activities that log creation, updates, deletions, and membership changes for administrative units. |

> [!NOTE]
> **Note:**
> 
> Microsoft Azure is a continuously updated cloud service. As of this document preparation, the latest release was in [September 2025](https://learn.microsoft.com/en-us/azure/developer/intro/azure-developer-overview).

## Prerequisites

- The user should have access to the [Azure](https://portal.azure.com/) portal with an account that has the Global Administrator privilege.
- The user should have access to the DataBee console.

## Configuration Overview

1. [Create an application](/user-manual/docs/azure-audit-new#create-an-application) with required permissions to fetch the data.
2. Add the [Azure Audit data feed](/user-manual/docs/azure-audit-new#databee-configuration) in the DataBee console with the below parameters.

| **DataBee Parameter** | **Azure Resource Logs Parameter** |
| --- | --- |
| Client ID | Application (client) ID |
| Client Secret | Client Secret Value |
| Tenant ID | Directory (Tenant) ID |
| Blob Account Name | Storage Account Name |
| Blob Container Name | Container Name |
| Azure Queue Name | Queue Name |

## Azure Audit Logs Configuration

To create an Azure Blob storage, need to follow below steps

### Create an application

1. Log on to [Azure](https://portal.azure.com/) with a user account that has the **Global Administrator** privilege.
2. In the **search bar**, search for **App registrations** and select it. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-p2rogyth.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
3. On the “App registrations” page click on the **New registration**, the “Register an application” window will appear. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image-1761813393889.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
4. On the “Register an application” window:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-0spthl7w.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
  1. Under **Name** enter your Application Name then click on **Register** to create the application.
5. On the app **Overview** page, copy the **Application (client) ID** and **Directory (tenant) ID** for later use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-2ge6xe8t.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)

### Create client secret

1. Select the [application](/user-manual/docs/azure-audit-new#create-an-application) created above.
2. Under **Manage**, click **Certificates & secrets**, and then click on **Client secrets**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image-1761813524433.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
3. Click **New client secret**. “Add a client secret” window appears. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image-1761813618206.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
4. In “Add a client secret” window:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-wyz5g1em.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)

> [!NOTE]
> **Note**:
> 
> The user needs to re-create the client secret when it expires
  1. Enter a **Description** for this client secret and select the desired expiry period from the **Expires** drop-list.
  2. Then click on **Add** to create the client secret.
5. Copy the **Value** fields for later use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image-1761813713811.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)

### Create Storage Account

1. Navigate to the home page and search for the **Storage accounts**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-nr39bund.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
2. To create a new storage account, ensure the user has the [necessary permissions](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json&tabs=azure-portal) to create one and follow the steps outlined [here](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-create?tabs=azure-portal). To use an existing storage account, proceed to step 3.
3. Open the **Storage accounts**, locate and select the desired storage account. Copy the **Storage Account Name** for future reference. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image-1761813839215.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)

### Assign Role to Application

1. In storage account, assign the created Azure AD App to a Role that grants access to the storage blob.
2. Navigate to **Access Control (IAM)** under the **Storage accounts** and click on **Add**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-ho9afowq.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
3. Assign the appropriate role for the Application.

| **Role** | **Description** |
| --- | --- |
| Storage Blob Data Contributor | Allows read/write/delete access to blob objects. |
| Storage Queue Data Contributor | Allows to send/read/delete messages in queues. |
| Storage Account Contributor | Provides full control over the storage account. |

1. In the **Add role assignment** pane, use the **search bar** to type the desired role and select it from the list. Once selected, click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-tgsjh8kr.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
2. Select the member for the role assignment.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-mwz1qb4u.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
  1. Click on **Select members**.
  2. Search for the application created during the app registration process and click on **Select**.
3. Click **Next** to continue. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-3p6huet6.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
4. Click **Next** to continue. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-uwgulgy7.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
5. Click **Review + Assign** to finalize the role assignment. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-tnbjypn9.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
6. To verify the role assignment

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-06pevij9.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
  1. Navigate to **Access Control (IAM)** > **Role assignments**
  2. Search for the application and assigned role for storage blob would be visible.

### Creating a Queue for Blob Storage

1. To read the data from blob storage we need a queue.
2. In the storage account, Click on **Data storage** > **Queues**.
3. Go to **Queues** and click on **+ Queue** to create a new queue.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-6mgaxqqm.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
  1. Enter a queue name and click on **OK**.
4. To set up event notification, go to the **Events** tab and click on **+ Event Subscription**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-9pmt3g6v.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
5. Provide **EVENT SUBSCRIPTION DETAILS**, **TOPIC DETAILS** and **EVENT TYPES**:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-9lz5awj0.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
  1. Enter the event name.
  2. Choose **Event Grid Schema** as event schema.
  3. Add **System Topic Name** if not added already.
  4. Select **Blob Created** as the Filter to Event Types.
6. Select **Storage Queue** as the Endpoint Type. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-277rnzdo.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
7. Provide **ENDPOINT DETAILS** to configure the endpoint:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-3xtyp2ve.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
  1. Click on **Configure an endpoint** option.
  2. Select the appropriate **Subscription** and **Storage account** values.
  3. Select the **Select existing queue** option and choose the queue created previously.
  4. Click **Select**.
8. Click **Create** to finalize the event subscription. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-8wvrh8bc.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)

### Forwarding the Audit logs to Blob Storage

To forward the Azure Audit logs of the administrative category to the blob storage account that you created, follow below steps.

1. Navigate to the home page and search for the **Audit Logs**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-d5lvg5yu.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
2. Click on **Export Data Settings**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-5um6s0be.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
3. Click on **Add Diagnostic Setting**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-npl4ioxe.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
4. Select the **Audit Logs** category and choose the **Archive to a storage account**. Fill the below details. Click **Save**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-8kkxu8wf.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
5. A new container will be created in your storage account, which will be used in the Databee configuration. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-t09vainy.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-st5uuqhg.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
2. Search for **Azure Audit** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-jvpglw95.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
3. Click on the **Azure Blob** option. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-a49y8p5p.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-zvtnu4hd.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
5. In the configuration page, confirm the following:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-royy5m83.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
  - **Client ID**: Paste the Application ID
  - **Client Secret**: Paste the Secret Value
  - **Tenant ID**: Paste the Directory ID
6. In the configuration page, confirm the Azure Blob Storage details:

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/azure-audit-blob-storage-image-cvo9nnd8.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A07Z&se=2026-10-30T12%3A35%3A07Z&sr=c&sp=r&sig=%2FiBDZAwAPD4NA47jruqyr3WjxqaQsmjHaTcGQtBP8cE%3D)
  - **Blob Account Name**: Paste the Storage Account name
  - **Blob Container Name:** Paste the Storage Container name
  - **Compression**: none
  - **Content Type**: JSON Lines
  - **Azure Queue Name**: Paste the Queue name
7. Click **Submit**.

## Troubleshooting Tips

- In case of any permission errors, ensure that proper roles are assigned to the application in the storage created.

#