My company offloads Azure AD audit logs to an Azure Storage Account. I need to dig into those logs to determine last modification date for some user accounts. I installed the Azure Storage Explorer on my local machine, but that does not have the capability to query the audit logs. What is the best tool to query the logs in the Storage Account? Thank you for your time.

Hi @Shawn Goodwin Thank you for asking this question on the **Microsoft Q&A Platform. ** The best way is to download the logs and use a tool like Visual Studio Code to look for the information that you require. Hope this helps! ---------- Accept Answer and Upvote , if any of the above helped, this thread can help others in the community looking for remediation for similar issues. NOTE: To answer you as quickly as possible, please mention me in your reply.

Best tool to query AzureAD audit logs from Storage Account.

Accepted answer

Carlos Solís Salazar 17,791 Reputation points MVP

2022-11-09T21:10:52.073+00:00

Hi @Shawn Goodwin

Thank you for asking this question on the **Microsoft Q&A Platform. **

The best way is to download the logs and use a tool like Visual Studio Code to look for the information that you require.

Hope this helps!

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.
NOTE: To answer you as quickly as possible, please mention me in your reply.
Please sign in to rate this answer.

1 person found this answer helpful.
Shawn Goodwin 156 Reputation points

2022-11-09T23:40:52.797+00:00

Thank you, @Carlos Solís Salazar

As much as I love that answer, because I can get what I need with some basic scripting, I do need to take this a step further and automate these data pulls. My question explanation was a little near-sighted and I should have elaborated some more. I intend to create some automation to pull a monthly report/export showing auditable changes on AAD accounts which have AAD roles assigned. We need to do this per SOC2 compliance.

I will download the logs and get what I need manually tonight, but what is the best automation tool going forward? Thank you!

Edit: spelling

Carlos Solís Salazar 17,791 Reputation points MVP

2022-11-10T14:57:31.693+00:00

@Shawn Goodwin in the case that this report will be a regular activity, I will recommend you these tools:

Integrate Azure AD logs with Azure Monitor logs

or

Install and use the log analytics views for Azure Active Directory

It will be even better if you implement both solutions

After you create a report, you can schedule and send them via email:

Source : https://cloudblogs.microsoft.com/industry-blog/en-gb/cross-industry/2020/06/17/log-analytics-or-azure-sentinel-how-schedule-a-report/

Hope this helps!
Sign in to comment

Share via

Best tool to query AzureAD audit logs from Storage Account.

0 additional answers