Skip to content
eSHARS Operations

Activity Log Audit

How to query the Azure Activity Log via CLI to see what changed on a resource, when, and by whom.

Prerequisites

  • Azure CLI authenticated (az login)
  • Appropriate Reader (or higher) role on the target subscription

Get the Resource ID

Activity log queries require the full resource ID. Get it for any VM:

Terminal window
az vm show \
  --name <vm-name> \
  --resource-group <resource-group> \
  --query id -o tsv

Save it for reuse:

Terminal window
VMID=$(az vm show --name vm-ssrs16-prod --resource-group rg-eshars-prod --query id -o tsv)

Query Activity Log

Last 7 days

Terminal window
az monitor activity-log list \
  --resource-id "$VMID" \
  --offset 7d \
  -o table

Last 14 days

Terminal window
az monitor activity-log list \
  --resource-id "$VMID" \
  --offset 14d \
  -o table

Custom date range

Terminal window
az monitor activity-log list \
  --resource-id "$VMID" \
  --start-time 2026-02-05T00:00:00Z \
  --end-time 2026-02-19T00:00:00Z \
  -o table

Formatting: Key Columns Only

Show operation, status, timestamp, and who made the change:

Terminal window
az monitor activity-log list \
  --resource-id "$VMID" \
  --offset 14d \
  --query "[].{Operation:operationName.localizedValue, Status:status.localizedValue, Time:eventTimestamp, Caller:caller, Category:category.localizedValue}" \
  -o table

Filtering Out Noise

Exclude Microsoft.Advisor recommendations

The portal shows Advisor recommendations mixed in with real changes. Filter them out:

Terminal window
az monitor activity-log list \
  --resource-id "$VMID" \
  --offset 14d \
  --query "[?caller!='Microsoft.Advisor'].{Operation:operationName.localizedValue, Status:status.localizedValue, Time:eventTimestamp, Caller:caller}" \
  -o table

Only actual changes (writes and actions)

Terminal window
az monitor activity-log list \
  --resource-id "$VMID" \
  --offset 14d \
  --query "[?contains(operationName.value, '/write') || contains(operationName.value, '/action')].{Operation:operationName.localizedValue, Status:status.localizedValue, Time:eventTimestamp, Caller:caller}" \
  -o table

Other Resource Types

The same pattern works for any Azure resource — not just VMs. Replace the az vm show with the appropriate command:

Terminal window
# App Service
az webapp show --name <app-name> --resource-group <rg> --query id -o tsv


# SQL Server
az sql server show --name <server-name> --resource-group <rg> --query id -o tsv


# SQL Database
az sql db show --name <db-name> --server <server-name> --resource-group <rg> --query id -o tsv


# Key Vault
az keyvault show --name <vault-name> --query id -o tsv


# By resource group (all resources in the group)
az monitor activity-log list --resource-group <rg> --offset 14d -o table

Notes

  • Activity Log retains events for 90 days (--offset max is 90d)
  • For longer retention, route logs to a Log Analytics workspace via diagnostic settings
  • The CLI returns empty results (no error) if the resource ID is invalid — double-check with echo "$VMID"