// tools/activity-log

Activity log storyteller

Load an Azure Activity log export and read it as a story: who changed what, when, and whether it worked. Role assignments, deleted locks, opened ports, deleted databases and other risky changes are flagged, and you can see what each change sent to Azure.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Activity log (JSON or CSV)

load export

Get the log

shell2 lines

1
2# the last 7 days for a resource group (use --subscription for everything)
az monitor activity-log list --resource-group rg-contoso-prod --offset 7d > activity.json

kql4 lines

1
2
3
4AzureActivity
| where TimeGenerated > ago(7d)
| where CategoryValue == "Administrative"
| project TimeGenerated, Caller, OperationNameValue, ActivityStatusValue, _ResourceId, ResourceGroup, CorrelationId, Properties

Run the KQL in Log Analytics and export the results as CSV. Started, accepted and succeeded entries for the same change are grouped together by correlation ID.

The Activity log records what was requested, not the previous values. To see before and after values, use Change Analysis in the Azure portal.

Sources