question

TryingtolearnNewStuff avatar image
0 Votes"
TryingtolearnNewStuff asked TryingtolearnNewStuff commented

How to determine who created a resource on Azure?

We are trying to identify the owner of a resource on Azure. Is there a PowerShell query or a REST API that will let me display a resource group or app service along with the owner's name and the date of creation?

azure-monitor
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

DavidBroggy-5270 avatar image
0 Votes"
DavidBroggy-5270 answered TryingtolearnNewStuff commented

Hi @TryingtolearnNewStuff
First of all, you need to get those logs stored in a Log Analytics Workspace.
They don’t sit around in the graph space so you have to store them somewhere.
You do this by pointing the diagnostic logs to a Log Analytics Workspace as described here:
analysis-services-logging

Once you have the logs stored in a workspace you can open it and use KQL to easily query all Azure activity.

Even cooler, get into Microsoft Sentinel and learn about SIEMs.

Also yes you can use powershell and Azure AD commands to search this activity ONCE it’s stored in a log analytics workspace, but the first step it to get it in there.

Hope that helps!

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you for replying. The resources I am looking at were created more than a year ago. So this is something that can be done going forward. Right now is there any way to identify the users who have created the resources?

0 Votes 0 ·