This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 19%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJ%3C/text%3E%3C/svg%3E)
Hi,
Our Azure audit logs don't seem to be capturing events like adding or deleting a secret to/from key vault. I expected that security-related events would automatically be captured in the audit logs, but unfortunately this is not the case. Can anyone help provide some guidance for how we can get this type of event for all of our resources to show up in our audit logs?
Thanks, Stanislav Zhelyazkov! Is there a way to globally enable high-level security events to be logged across all of our subscriptions rather than enabling this on an individual resource? We'd like to something similar to how AWS CloudTrail works ...log all management events, such as attaching roles, creating VPCs, etc.
Hi,
Deleting a secret event is part of the audit events for Key Vault.
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Thanks, Stanislav! Are there any security-related events related to infrastructure that are logged to the audit logs by default, or does this need to be enabled for each resource? I was hoping there was a way to globally enable some high-level (e.g. adding or deleting firewall rules, virtual networks, etc) security events to be logged across all of our subscriptions. (Please note: I apologize that I've posted a second comment which is somewhat redundant. I am new to this forum and didn't realize there was a delay in this information appearing. I'll leave the second comment, since it may help clarify my goal. Thanks again!)
You can use Azure Policy to check and configure diagnostic settings on Key Vaults or other resources. For Key vault specifically the policy is Deploy Diagnostic Settings for Key Vault to Log Analytics workspace. There are other built-in policies for other resources as well. Keep in mind that different resources have different logs. In general Management plane operations are logged in Azure Activity log for the subscription. The Azure activity log is available for 90 days and can also be send to Log Analytics workspace via diagnostic settings. If the service has data plane operations like Key Vault any audit logs will be available via diagnostic settings on the resource. In the case of Key Vault secrets are data plane resource thus why available as separate log via diagnostic settings.
Thank you!