Azure SQL Database
An Azure relational database service.
Go to Azure Portal (Your SQL Server)
Make sure "Audit all actions and events" is ON or select them manually.
Azure SQL database audit logs (for CREATE/UPDATE/DELETE/DROP/ALTER) not working.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 65%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESN%3C/text%3E%3C/svg%3E)
Sagar Nagadiya
0
Reputation points Microsoft Employee
After enabling SQL Auditing on both the Azure SQL Server and Azure SQL Database, and configuring audit logs to be sent to the Log Analytics workspace, we are not seeing audit events for CREATE, UPDATE, DELETE, DROP, or ALTER operations in the workspace.
Has anyone encountered this issue before? Is there any known configuration or limitation that could cause these audit logs not to appear?
Azure SQL Database
-
Erland Sommarskog 135.5K Reputation points MVP Volunteer Moderator2026-07-08T13:13:43.03+00:00 Since you talk about log analytics workspace, is this in Azure SQL Database or Azure SQL Database Managed Instance? In such case, you may want to change the tag to Azure SQL Database.
-
Sagar Nagadiya 0 Reputation points Microsoft Employee
2026-07-08T13:41:37.31+00:00 Azure SQL database
-
Erland Sommarskog 135.5K Reputation points MVP Volunteer Moderator
2026-07-08T14:47:35.5233333+00:00 I've changed the tag, so that you get better visibility from the Azure people.
The problem as such seems to be familiar. I think I've people to ask about this before. I seem to recall that the Azure service needs permission to write to the log analytics workspace. Have you set this up?
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 2%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMK%3C/text%3E%3C/svg%3E)
Manoj Kumar Boyini 18,675 Reputation points Microsoft External Staff Moderator2026-07-08T16:28:08.5133333+00:00 In Log Analytics, are you querying
AzureDiagnosticsand filtering bycategory == "SQLSecurityAuditEvents"?- Do you see any SQL auditing events in the workspace at all (for example, successful/failed authentication groups), or is it completely empty?
- How is auditing configured (portal UI vs ARM/Bicep vs PowerShell/REST)? If template-based, what API version is used?
- Are there any RBAC changes or role assignments around the SQL resource, the Log Analytics workspace, or Azure Monitor/Diagnostic settings?
- Which specific action groups/actions did you enable for CREATE/UPDATE/DELETE/DROP/ALTER?
Sign in to comment
2 answers
Sort by: Most helpful
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 5%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAV%3C/text%3E%3C/svg%3E)
Andre Van Zyl 0 Reputation points2026-07-09T02:12:41.0033333+00:00 -
Alberto Morillo 35,506 Reputation points MVP Volunteer Moderator2026-07-09T01:58:18.6666667+00:00 Try to run the following simple query first, just provide the subscription ID, resource group and database name on the WHERE clause. Maybe filtering this way you get results.
AzureDiagnostics | where ResourceId == '/SUBSCRIPTIONS/<your subsciption ID>/RESOURCEGROUPS/<your rsrc grp>/PROVIDERS/MICROSOFT.SQL/SERVERS/<YOURSERVERNAME>/DATABASES/<YOURDBNAME>' | project event_time_t, statement_s, succeeded_s, affected_rows_d, server_principal_name_s, client_ip_s, application_name_s, additional_information_s, data_sensitivity_information_s | order by event_time_t desc | take 100