Need Help on to get the creted by info for azure resources

kks8589 96

Hello Team,
We are in process of cleaning up the Azure resources that are not getting used.
we have resources which were created 2 years back like storage accounts resource groups etc

In Activity log we might get info till past 90 days . So in this scenario how to get the mail id of the members who created it as there are no owner tags too for the resources

AnuragSingh-MSFT 19,691 Reputation points

2022-04-25T09:04:06.843+00:00

@kks8589 , Following up to see if the answer below helps. Do let us know if you have any queries.

Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.

1 answer

Alistair Ross 7,101 Reputation points Microsoft Employee

2022-04-20T14:24:52.777+00:00

Short Answer: You cannot.
Long Answer: Unless you have been collecting the activity logs for the period of time you need (up to 2 years in Log Analytics, 90 days for free) or longer by exporting the logs, then you cannot see who created the resources. Azure Resource Manager does not keep historical logs of all events that have occurred, but the state that they are in now and the activity logs.
Please sign in to rate this answer.

1 person found this answer helpful.
Andrew Blumhardt 9,491 Reputation points Microsoft Employee

2022-04-20T15:55:54.38+00:00

You might try looking in the Resource Graph: https://learn.microsoft.com/en-us/azure/governance/resource-graph/first-query-portal

Alistair Ross 7,101 Reputation points Microsoft Employee

2022-04-20T16:12:46.53+00:00

@Andrew Blumhardt , Can you provide an example of this? As far as I know there isn't a "created by " or equivalent property on Azure Resources, therefore I am not sure how Azure Resource Graph would help.

Andrew Blumhardt 9,491 Reputation points Microsoft Employee

2022-04-20T19:51:31.38+00:00

Just a hunch. You are correct. That would be nice though. :-)

kks8589 96 Reputation points

2022-04-29T06:35:10.213+00:00

If i have storage accounts data tagged to log analytics workspace what can be the kusto query to see who has created the container or deleted or modified

Alistair Ross 7,101 Reputation points Microsoft Employee

2022-04-29T13:23:40.053+00:00

Hi @kks8589 .

Ensure your Azure Activity is being sent to a Log Analytics workspace https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log#send-to-log-analytics-workspace

Perform the action you are wishing to audit (such as create a container in a storage account)

Run a query to identify the performed operations

AzureActivity
| where OperationNameValue startswith "MICROSOFT.STORAGE"

Identify the required Operation and project the required columns

AzureActivity
| where OperationNameValue == "MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE"
| where ActivitySubstatusValue == "Created"
| where ActivityStatusValue == "Success"
| extend Resource = tostring(parse_json(Properties).resource)
| project TimeGenerated, _ResourceId, ResourceGroup, Resource, Caller
Sign in to comment