Azure Activity Administrative

1. Which Log Category should enable to capture Activity Logs?

Administrative Log category should be enabled at Azure Subscription level to capture the Azure Activity Logs.

2. What is default retention period for Azure Activity Logs?

The default retention period for Azure Activity Logs is 90 days. Activity Logs will automatically delete events that are older than 90 days.

3. Can we store the Activity Log for a longer time?

Yes, we can increase the Activity Log retention period by storing Logs in Azure Storage or a Log Analytics workspace. The pricing for log stored is based on the volume of data that you store and the retention period.

Azure Activity “Administrative” logs are a type of activity log that record events that occur in your Azure subscription. By enabling and configuring the Azure Activity “Administrative” logs will collect and store logs in your specified log analytics workspace (this is your log destination). Administrative logs help you to view and analyze the logs to track changes to your Azure resources and identify any suspicious activity. In this article, we will use a PowerShell script, which is a flexible and scriptable way to configure and manage diagnostic settings.