Need check a logs of the document inteeligence

Question

Need check a logs of the document inteeligence

Jagan S 0

Need to know where to check the logs and someone deleted the trained model it is second time it's urgent we need to check

Sridhar M 5,335 Reputation points Microsoft External Staff Moderator

2026-02-19T14:32:17.7733333+00:00
Hi Jagan S

you're really in a tough spot with the deletion of your trained model and needing access to logs for Document Intelligence. Here’s what you can do to check the logs and potentially find out who deleted the model:

Check Diagnostic Settings:

Go to the Azure portal.

Select your Azure Document Intelligence resource.

Navigate to Monitoring and then select Diagnostic Settings.

Ensure that the necessary logs are enabled and routed to a Log Analytics workspace, Azure Storage, or Event Hub. This is critical for capturing the relevant access logs.

Querying Logs:

You can use Azure Monitor Logs to query access-related data. Here’s a basic example of how to structure your query with Kusto Query Language (KQL):
AzureDiagnostics | where ResourceId contains "YourResourceID" // Replace with your actual Resource ID | where TimeGenerated > ago(30d) // Adjust the timeframe as needed | project TimeGenerated, CallerIpAddress, OperationName

Backup and Restore:

For backing up your trained model, you should consider exporting it to Azure Blob Storage. This process generally involves calling the API that allows you to export your model data.

To restore, you can use the Azure Blob Storage methods to retrieve your model files and then re-import them back into your Azure Document Intelligence setup.

Activity Log:

Additionally, the Azure Activity Log might help you track operations related to resources in your subscription. This log contains subscription-level events that can indicate who deleted the resource.
Jagan S 0 Reputation points

2026-02-19T14:37:40.1466667+00:00

We need to know who deleted the trained model from the document intelligence and need to know how to take backup and restore in azure blob
Sridhar M 5,335 Reputation points Microsoft External Staff Moderator

2026-02-19T15:01:06.0866667+00:00

Hi Jagan S

Did you get any chance to review the above response. Thank you!
Sridhar M 5,335 Reputation points Microsoft External Staff Moderator

2026-02-19T15:05:40+00:00

Hi Jagan S

please find the above steps to take backup and restore in azure blob

Reference:https://learn.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest
Jagan S 0 Reputation points

2026-02-19T16:43:45.1033333+00:00

Everything is uncheck in diagnostic setting
Manas Mohanty 14,750 Reputation points Microsoft External Staff Moderator

2026-02-23T17:40:58.6166667+00:00

Hi Jagan S

Please share the details on resource id of Documentation intelligence and other details on private message for further investigation.

Thank you.

2 answers

Your answer

Sridhar M 5,335 Reputation points Microsoft External Staff Moderator

2026-02-19T14:32:17.7733333+00:00

Hi Jagan S

you're really in a tough spot with the deletion of your trained model and needing access to logs for Document Intelligence. Here’s what you can do to check the logs and potentially find out who deleted the model:

Check Diagnostic Settings:

Go to the Azure portal.

Select your Azure Document Intelligence resource.

Navigate to Monitoring and then select Diagnostic Settings.

Ensure that the necessary logs are enabled and routed to a Log Analytics workspace, Azure Storage, or Event Hub. This is critical for capturing the relevant access logs.

Querying Logs:

You can use Azure Monitor Logs to query access-related data. Here’s a basic example of how to structure your query with Kusto Query Language (KQL):
AzureDiagnostics | where ResourceId contains "YourResourceID" // Replace with your actual Resource ID | where TimeGenerated > ago(30d) // Adjust the timeframe as needed | project TimeGenerated, CallerIpAddress, OperationName

Backup and Restore:

For backing up your trained model, you should consider exporting it to Azure Blob Storage. This process generally involves calling the API that allows you to export your model data.

To restore, you can use the Azure Blob Storage methods to retrieve your model files and then re-import them back into your Azure Document Intelligence setup.

Activity Log:

Additionally, the Azure Activity Log might help you track operations related to resources in your subscription. This log contains subscription-level events that can indicate who deleted the resource.
Jagan S 0 Reputation points

2026-02-19T14:37:40.1466667+00:00

We need to know who deleted the trained model from the document intelligence and need to know how to take backup and restore in azure blob
Sridhar M 5,335 Reputation points Microsoft External Staff Moderator

2026-02-19T15:01:06.0866667+00:00

Hi Jagan S

Did you get any chance to review the above response. Thank you!
Sridhar M 5,335 Reputation points Microsoft External Staff Moderator

2026-02-19T15:05:40+00:00

Hi Jagan S

please find the above steps to take backup and restore in azure blob

Reference:https://learn.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest
Jagan S 0 Reputation points

2026-02-19T16:43:45.1033333+00:00

Everything is uncheck in diagnostic setting
Manas Mohanty 14,750 Reputation points Microsoft External Staff Moderator

2026-02-23T17:40:58.6166667+00:00

Hi Jagan S

Please share the details on resource id of Documentation intelligence and other details on private message for further investigation.

Thank you.

Answer 1

Hi Jagan S

Old deletion events won't be recorded in diagnostic setting.

Creation of Diagnostic setting

We need to create a new diagnostic setting to route telemetry to log analytic workspace.

While creating new Diagnostic setting

Please select "Send to log Analytics workspace" on Destination details.

Category group- Audit, all Logs

Categories- Audit, Response and Request, Trace logs.

Note: A log analytics workspace is provisioned normally during resource creation, Please create one if not available.

On Log analytic workspace

You can modify and run below query in Log analytic workspace to find IPS address, Caller etc.

AzureActivity
| where TimeGenerated > ago(7d)
| where ResourceProviderValue == "Microsoft.CognitiveServices"
| where OperationNameValue has_any ("delete", "Delete")
| project
    TimeGenerated,
    OperationNameValue,
    ActivityStatusValue,
    Caller,
    CallerIpAddress,
    ResourceGroup,
    ResourceId,
    CorrelationId
| order by TimeGenerated desc

ResourceManagementPublicAccessLogs
//| where Category == "PublicAccessLogs"
| where TimeGenerated > ago(7d)
//| where ResourceProviderValue == "Microsoft.CognitiveServices"
| where OperationName has_any ("delete","Delete")

| summarize count() by ObjectIdentifier
| order by count_

Reference - https://learn.microsoft.com/en-us/azure/azure-monitor/reference/queries/azureactivity

You can restrict roles to Cognitive service user (only inference calls work, model creation and deletion would be restricted)

Thank you.

Manas Mohanty 14,750 Reputation points Microsoft External Staff Moderator

2026-02-26T16:20:41.5966667+00:00

Hi Jagan S

Just got reviewed from product group. It won't be fully possible to track user identity yet, but we can track with object id associated with user.

But please log the events to log analytic workspace for tracking and restrict users to Cognitive service user who need to send only inference request.

Please take a moment to accept this answer if you found the pointers helpful.

Thank you for using Azure Services.

Answer 2

To check the logs for the Document Intelligence service, you can use the Get model API to track the status of your trained model. You can query the target model using the target model ID that you obtained during the model generation process. Here’s how you can do it:

Use the following GET request to track the model:
```
   GET https://<your-resource-endpoint>/documentintelligence/documentModels/{modelId}?api-version=2024-11-30
```
Replace <your-resource-endpoint> with your actual resource endpoint and {modelId} with the ID of your model.

Include your subscription key in the header:

   Ocp-Apim-Subscription-Key: <your-key>

In the response, you will find information about the model, including its status, which can help you understand what happened to your trained model.

If you need to check logs related to the operations performed, you can also track the copy progress of operations using the operation ID provided during the copy request.

References:

Share via

Need check a logs of the document inteeligence

2 answers

Your answer