Edit

Enable audit logging for Microsoft Discovery resources

Microsoft Discovery supports customer-configurable audit logging through Azure Monitor diagnostic settings. When enabled, audit and platform logs are exported from Discovery resources to an Azure Storage account or a Log Analytics workspace that you control, where they can be retained for compliance, security auditing, and long-term analysis.

Audit logs are distinct from the application logs that Discovery automatically collects in Managed Resource Group (MRG) Log Analytics workspaces. Audit logs must be explicitly enabled by you and are written to a destination in your own subscription. For an overview of all log types, see Observability in Microsoft Discovery.

Supported resource types and log destinations

You can enable audit logging on the following Microsoft Discovery resource types:

Resource type Resource provider path
Workspace Microsoft.Discovery/workspaces
Bookshelf Microsoft.Discovery/bookshelves
Supercomputer Microsoft.Discovery/supercomputers

The following destinations are supported for audit log export:

  • Azure Storage Account - Archive logs for compliance, auditing, and long-term retention.
  • Log Analytics workspace - Query logs with KQL and integrate with Azure Monitor alerts and workbooks.

Prerequisites

Connect to Azure

Sign in to Azure PowerShell and set the subscription context:

Connect-AzAccount
Set-AzContext -SubscriptionId "<subscription-id>"

Configure the log category

Before you create a diagnostic setting, define which log categories to collect. You can export all available log categories or audit logs only.

To collect all available log categories:

$log = New-AzDiagnosticSettingLogSettingsObject `
    -Enabled $true `
    -CategoryGroup "allLogs"

Export to a storage account

Use the New-AzDiagnosticSetting cmdlet to create a diagnostic setting that sends logs to a storage account. Select the tab for your Discovery resource type and replace the <placeholder> values with your resource information.

New-AzDiagnosticSetting `
    -Name "<diagnostic-setting-name>" `
    -ResourceId "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Discovery/workspaces/<workspace-name>" `
    -StorageAccountId "/subscriptions/<subscription-id>/resourceGroups/<storage-resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account-name>" `
    -Log $log

Export to a Log Analytics workspace

Use the New-AzDiagnosticSetting cmdlet to create a diagnostic setting that sends logs to a Log Analytics workspace. Select the tab for your Discovery resource type and replace the <placeholder> values with your resource information.

New-AzDiagnosticSetting `
    -Name "<diagnostic-setting-name>" `
    -ResourceId "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Discovery/workspaces/<workspace-name>" `
    -WorkspaceId "/subscriptions/<subscription-id>/resourceGroups/<log-analytics-resource-group>/providers/Microsoft.OperationalInsights/workspaces/<log-analytics-workspace-name>" `
    -Log $log

Parameter reference

Placeholder Description
<diagnostic-setting-name> A descriptive name for the diagnostic setting.
<subscription-id> The Azure subscription ID that contains the Discovery resource.
<resource-group> The resource group of the Discovery resource.
<workspace-name> The name of the Microsoft Discovery workspace.
<bookshelf-name> The name of the Microsoft Discovery bookshelf.
<supercomputer-name> The name of the Microsoft Discovery supercomputer.
<storage-resource-group> The resource group of the destination storage account.
<storage-account-name> The name of the destination Azure Storage account.
<log-analytics-resource-group> The resource group of the destination Log Analytics workspace.
<log-analytics-workspace-name> The name of the destination Log Analytics workspace.

Verify the diagnostic setting

To confirm that the diagnostic setting was created successfully:

Get-AzDiagnosticSetting `
    -ResourceId "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Discovery/<resource-type>/<resource-name>"

Replace <resource-type> with workspaces, bookshelves, or supercomputers, and <resource-name> with the name of your resource.

A successful response returns the diagnostic setting name, the configured destination, and the enabled log categories.

Note

Audit logs can take several minutes to appear in the destination after you create the diagnostic setting.

Manage log retention

To control how long audit logs are retained, use the following approaches based on your destination:

  • Storage account - Configure a lifecycle management policy on the destination storage account to automatically expire or archive log blobs.
  • Log Analytics workspace - Configure the data retention settings on the Log Analytics workspace to set the retention period for ingested tables.

Related content

  • Last updated on