I have a virtual network and someone had added DDoS Protection on it. But I actually wanted to figure out when it has been enabled and by whom it has been enabled. How do I check this information from Azure Portal or via Azure CLI?

This will be in the Azure activity log - https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log#view-the-activity-log You can check this at the subscription level, the resource group or resource level so for this scenario maybe select the virtual network resource where DDOS protection was enabled and review the corresponding activities in the activity log.

How to find the name of the User Account who had enabled DDOS Protection?

Accepted answer

Alan Kinane 16,811 Reputation points MVP

2022-01-25T16:20:59.19+00:00

This will be in the Azure activity log - https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log#view-the-activity-log

You can check this at the subscription level, the resource group or resource level so for this scenario maybe select the virtual network resource where DDOS protection was enabled and review the corresponding activities in the activity log.
Please sign in to rate this answer.
David Maryo 111 Reputation points

2022-01-25T17:30:25.947+00:00

What if it had been set 90 days before? I hope currently the timespan can only be set for 90 days. In that case, we won't be able to check those logs?

Alan Kinane 16,811 Reputation points MVP

2022-01-26T09:23:14.843+00:00

Correct it's a 90 day log, unless you are archiving the activity logs.

David Maryo 111 Reputation points

2022-01-26T15:51:46.937+00:00

Actually, I wanted to check the logs before 90 days.. First of all, I wanted to check whether we are archiving the activity logs.. From where can I check this information?

Alan Kinane 16,811 Reputation points MVP

2022-01-26T16:39:03.443+00:00

If you check the diagnostic settings maybe you are sending the logs to a storage account, log analytics or event hub. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log

If you don't have the logs and it is beyond the 90 days then I don't think there is any way to know who enabled this service unless perhaps Microsoft have visibility over this internally but I believe they will just refer to the same activity log.
Sign in to comment

Share via

How to find the name of the User Account who had enabled DDOS Protection?

0 additional answers