azure-monitor-audit

Configure Azure Monitor diagnostic settings to export activity logs to Log Analytics.

46|4|Updated Jan 27, 2026

Search Tags:#monitoring #audit #azure #compliance #activity log #log analytics

Ready to run

npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill azure-monitor-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: azure-monitor-audit
Source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/compliance/auditing/azure-monitor-audit
Command: npx skills add https://github.com/BagelHole/DevOps-Security-Agent-Skills --skill azure-monitor-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps you establish robust auditing practices for your Azure environment by configuring Azure Monitor and Activity Logs to capture and analyze critical events.

Core Features & Use Cases

Diagnostic Settings: Enables the capture of audit events from Azure resources.
Activity Log Export: Configures the export of administrative and security-related activity logs to a Log Analytics workspace for centralized analysis.
Log Analytics Queries: Provides example Kusto Query Language (KQL) queries to identify failed logins and administrative changes.
Use Case: Ensure compliance and security by automatically logging all administrative actions and failed login attempts within your Azure subscription, making them searchable and alertable.

Quick Start

Configure diagnostic settings for the specified resource to send audit events to the designated Log Analytics workspace.

Frequently Asked Questions about azure-monitor-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure Azure Monitor to audit administrative changes and failed logins?▼

To audit administrative changes and failed logins with Azure Monitor, you configure diagnostic settings to capture audit events and export Activity Logs to a Log Analytics workspace for centralized analysis and alerting.

What is the best way to centralize Azure Activity Logs for compliance monitoring?▼

Centralizing Azure Activity Logs for compliance involves exporting administrative and security logs to a Log Analytics workspace, enabling long-term archiving, searchable queries, and alert configuration for audit events.

How do I set up diagnostic settings in Azure to capture security audit events?▼

You capture security audit events in Azure by enabling diagnostic settings on specified resources, which routes the administrative and security activity logs directly to a designated Log Analytics workspace.

Can I use KQL queries in Log Analytics to identify failed Azure logins?▼

Yes, you can use Kusto Query Language (KQL) queries in Log Analytics to identify failed Azure logins, as the workspace contains exported administrative and security activity logs needed for compliance analysis.

Does configuring Azure Monitor for auditing require a Log Analytics workspace?▼

Yes, configuring Azure Monitor for auditing requires a Log Analytics workspace to export Activity Logs to, providing centralized logging, long-term archiving, and analysis capabilities for compliance monitoring.