Data diagnostic from Azure Storage Account doesn't capture RequesterID

Hii Dmytro Honcharuk

Welcome to the Microsoft Q&A Platform! Thank you for asking your question here.

When using private endpoints, access to the storage account might be limited, which can affect logging. Make sure the private endpoint is set up correctly and that the right permissions and network rules allow access from the clients or services that need it. Private endpoints are not available for general-purpose v1 storage accounts.

If you perform operations without authentication (like anonymous access), the logs might not show user information. Make sure to authenticate operations using Azure Active Directory (AAD) or a shared access signature (SAS).

check your diagnostic settings are correct so you capture the right logs and detailed information. Important logs for blob operations include BlobRead, BlobWrite, and BlobDelete.

Logs may take some time to show up in Log Analytics. If you just turned on diagnostic logging, it might take a while for the data to appear.

Retrieve Information

In the Azure Portal, open your Storage account. Click on Diagnostics settings under Monitoring. Make sure you're logging the needed categories for blob operations, like Blob Read, Blob Write, and Blob Delete.

Ensure clients accessing the storage account are logged in and that the logs show user details for their actions. If you aren't using it yet, consider using Azure Active Directory (AAD) for authentication.

Azure Activity Logs show actions taken on Azure resources, like storage accounts. You can look at these logs to find out who accessed your storage account.

When Create alerts based on the logs to notify you about certain actions. This will help you keep track of access patterns and ensure compliance.

For reference, please review this documentation:- https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints
https://learn.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices
https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings

If you have any further queries, do let us know.

If the answer is helpful, please click "Accept Answer" and "Upvote it".

Hii Dmytro Honcharuk
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!

Hii Dmytro Honcharuk
If you had a chance to see my comment to your question. If it was helpful, please click "Upvote" on my post let us know Thank you...!

Further investigation with Microsoft Support showed that the issue was that we were using auth keys that are not logging the requester. We need to use Entra for authentication. Thanks for support