Azure activity/subscription logs

Activity log key fields

The key fields in the subscription/activity log schema are:

• identity.claims: nested JSON with information about the identity that performed the action and its authentication method.

  • identity.claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn: the UPN of the identity that performed the action.

  • identity.claims.groups: the AzureAD groups of which the identity is a member.

  • identity.claims.ipaddr: the IP address the identity authenticated from.

• callerIpAddress: the IP address the action was performed from.

• resourceId: the unique resource identifier of the resource. The resourceId follows the format: /SUBSCRIPTIONS/<SUBSCRIPTION_ID>/RESOURCEGROUPS/<RESOURCEGROUP_NAME>/PROVIDERS/<PROVIDER>/<RESOURCE_NAME>.

  The provider can for example be /MICROSOFT.COMPUTE/VIRTUALMACHINES or MICROSOFT.STORAGE/STORAGEACCOUNTS.

• operationName: the name of the operation.

  Examples:

  • MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE
  • MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE
  • MICROSOFT.COMPUTE/VIRTUALMACHINES/START/ACTION
  • MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE
  • MICROSOFT.COMPUTE/DISKS/WRITE
  • MICROSOFT.STORAGE/STORAGEACCOUNTS/LISTKEYS/ACTION
  • …

• resultType and resultSignature (more verbose): the result of the operation.

• correlationId: an unique identifier that can be used to map the different events associated with a single operation.