Azure Audit New Resources Creation

Question

I’m trying to accomplish how can I get notify if a user/admin creates any new resource on azure tenant such as a new vm, storage account, database, etc etc anything.. I want to be able to get notify and generate report where possible. Also, in relation to this, I want to be able to export a list of all resources on a weekly basis, such as exporting to csv file either from azure cli/ ps or using a VM inside Azure to do it.

Answer 1

Hi @Razzi29 , to get notified when a new resource is created in your Azure tenant, you can use Azure Event Grid and Azure Automation to trigger a runbook when a new resource is created. Here's a high-level overview of the steps:

1. Import an Event Grid sample runbook into Azure Automation.
2. Create an optional Microsoft Teams webhook for notifications.
3. Create a webhook for the runbook.
4. Create an Event Grid subscription.
5. Create a VM that triggers the runbook. For exporting a list of all resources on a weekly basis, you can use Azure Cost Management to schedule exports of your Azure usage details into your Azure Storage accounts as blobs. You can then use tools like AzCopy or Azure Storage Explorer to download the exported CSV files. Here's a high-level overview of the steps to create a scheduled export in Azure Cost Management:
6. Create a daily month-to-date export for a subscription.
7. Configure the export with the required information, such as subscription ID, resource group name, and storage account details.
8. Set the export schedule and format (CSV). After setting up the scheduled export, you can use tools like AzCopy or Azure Storage Explorer to download the exported CSV files to your local machine or another storage location. For more details on setting up Azure Event Grid and Azure Automation, refer to this tutorial. For more information on setting up Azure Cost Management exports, refer to this guide. Please let me know if you have any questions and I can help you further. If this answer helped you please mark it as "Verified" so other users can reference it. Thank you, James

Answer 2

These are all part of the Azure Activity log. There should be some workbooks in Azure monitor for reporting. You can also create free alerts.

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-types#activity-log-alerts