Azure and Microsoft Entra¶
Azure Activity Log¶
Azure subscription control-plane activity. Ask: who performed what management operation against which resource?
| Field/concept | Use |
|---|---|
| Caller/claims | Identity and authentication context |
| Operation name | Management action |
| Resource ID/group/provider | Target and scope |
| Subscription/tenant | Administrative boundary |
| Correlation ID | Link related operations |
| Status/substatus | Result |
| Event timestamp | Timeline |
Microsoft Entra ID logs¶
| Log | Use |
|---|---|
| Sign-in logs | User/service sign-ins, result, IP, app, device, MFA, conditional access |
| Audit logs | User, group, app, credential, role, and policy changes |
| Provisioning logs | Automated identity lifecycle and provisioning actions |
| Risk detections | Identity Protection risk signals where licensed/enabled |
High-interest changes¶
- Role assignment or privileged-role activation
- New application/service principal, credential, or consent
- MFA/security-info or conditional-access changes
- New access credential, secret, certificate, or federated trust
- Network security group/firewall or public-access changes
- Logging, diagnostic setting, Defender, or policy changes
- Key Vault secret/key access and storage data access
Pivot next: Entra sign-in and audit sequence, Activity Log correlation ID, resource diagnostics/data-plane logs, Defender for Cloud alerts, NSG flow/network telemetry, and actions under the same token/identity.