Azure Activity Log

Azure Activity Log. Azure control-plane activity exported as structured events.

Source and collection

Activity Log / configured diagnostic destination.

Select subscriptions and export categories; record destination-specific envelopes.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 1

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: f8df819b342ef50baf0a73994fd7e2a139063b3c7b6137ea42db18260e424094

{
    "authorization": {
        "action": "Microsoft.Network/networkSecurityGroups/write",
        "scope": "/subscriptions/<subscription ID>/resourcegroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myNSG"
    },
    "caller": "rob@contoso.com",
    "channels": "Operation",
    "claims": {
        "aud": "https://management.core.windows.net/",
        "iss": "https://sts.windows.net/aaaabbbb-0000-cccc-1111-dddd2222eeee/",
        "iat": "1234567890",
        "nbf": "1234567890",
        "exp": "1234567890",
        "_claim_names": "{\"groups\":\"src1\"}",
        "_claim_sources": "{\"src1\":{\"endpoint\":\"https://graph.microsoft.com/aaaabbbb-0000-cccc-1111-dddd2222eeee/users/bbbbbbbb-1111-2222-3333-cccccccccccc/getMemberObjects\"}}",
        "http://schemas.microsoft.com/claims/authnclassreference": "1",
        "aio": "A3GgTJdwK4vy7Fa7l6DgJC2mI0GX44tML385OpU1Q+z+jaPnFMwB",
        "http://schemas.microsoft.com/claims/authnmethodsreferences": "rsa,mfa",
        "appid": "00001111-aaaa-2222-bbbb-3333cccc4444",
        "appidacr": "2",
        "http://schemas.microsoft.com/2012/01/devicecontext/claims/identifier": "cccccccc-2222-3333-4444-dddddddddddd",
        "e_exp": "262800",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Robertson",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Rob",
        "ipaddr": "111.111.1.111",
        "name": "Rob Robertson",
        "http://schemas.microsoft.com/identity/claims/objectidentifier": "bbbbbbbb-1111-2222-3333-cccccccccccc",
        "onprem_sid": "S-1-5-21-4837261184-168309720-1886587427-18514304",
        "puid": "18247BBD84827C6D",
        "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "b-24Jf94A3FH2sHWVIFqO3-RSJEiv24Jnif3gj7s",
        "http://schemas.microsoft.com/identity/claims/tenantid": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "rob@contoso.com",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "rob@contoso.com",
        "uti": "IdP3SUJGtkGlt7dDQVRPAA",
        "ver": "1.0"
    },
    "correlationId": "aaaa0000-bb11-2222-33cc-444444dddddd",
    "eventDataId": "aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e",
    "eventName": {
        "value": "EndRequest",
        "localizedValue": "End request"
    },
    "category": {
        "value": "Administrative",
        "localizedValue": "Administrative"
    },
    "eventTimestamp": "2018-01-29T20:42:31.3810679Z",
    "id": "/subscriptions/<subscription ID>/resourcegroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myNSG/events/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/ticks/636528553513810679",
    "level": "Informational",
    "operationId": "eeee4444-ff55-6666-77aa-888888bbbbbb",
    "operationName": {
        "value": "Microsoft.Network/networkSecurityGroups/write",
        "localizedValue": "Microsoft.Network/networkSecurityGroups/write"
    },
    "resourceGroupName": "myResourceGroup",
    "resourceProviderName": {
        "value": "Microsoft.Network",
        "localizedValue": "Microsoft.Network"
    },
    "resourceType": {
        "value": "Microsoft.Network/networkSecurityGroups",
        "localizedValue": "Microsoft.Network/networkSecurityGroups"
    },
    "resourceId": "/subscriptions/<subscription ID>/resourcegroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/myNSG",
    "status": {
        "value": "Succeeded",
        "localizedValue": "Succeeded"
    },
    "subStatus": {
        "value": "",
        "localizedValue": ""
    },
    "submissionTimestamp": "2018-01-29T20:42:50.0724829Z",
    "subscriptionId": "<subscription ID>",
    "properties": {
        "statusCode": "Created",
        "serviceRequestId": "ffff5555-aa66-7777-88bb-999999cccccc",
        "responseBody": "",
        "requestbody": ""
    },
    "relatedEvents": []
}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`authorization.action`	str
`authorization.scope`	str
`caller`	str
`channels`	str
`claims.aud`	str
`claims.iss`	str
`claims.iat`	str
`claims.nbf`	str
`claims.exp`	str
`claims._claim_names`	str
`claims._claim_sources`	str
`claims.http://schemas.microsoft.com/claims/authnclassreference`	str
`claims.aio`	str
`claims.http://schemas.microsoft.com/claims/authnmethodsreferences`	str
`claims.appid`	str
`claims.appidacr`	str
`claims.http://schemas.microsoft.com/2012/01/devicecontext/claims/identifier`	str
`claims.e_exp`	str
`claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname`	str
`claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname`	str
`claims.ipaddr`	str
`claims.name`	str
`claims.http://schemas.microsoft.com/identity/claims/objectidentifier`	str
`claims.onprem_sid`	str
`claims.puid`	str
`claims.http://schemas.microsoft.com/identity/claims/scope`	str
`claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier`	str
`claims.http://schemas.microsoft.com/identity/claims/tenantid`	str
`claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`	str
`claims.http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn`	str
`claims.uti`	str
`claims.ver`	str
`correlationId`	str
`eventDataId`	str
`eventName.value`	str
`eventName.localizedValue`	str
`category.value`	str
`category.localizedValue`	str
`eventTimestamp`	str
`id`	str
`level`	str
`operationId`	str
`operationName.value`	str
`operationName.localizedValue`	str
`resourceGroupName`	str
`resourceProviderName.value`	str
`resourceProviderName.localizedValue`	str
`resourceType.value`	str
`resourceType.localizedValue`	str
`resourceId`	str
`status.value`	str
`status.localizedValue`	str
`subStatus.value`	str
`subStatus.localizedValue`	str
`submissionTimestamp`	str
`subscriptionId`	str
`properties.statusCode`	str
`properties.serviceRequestId`	str
`properties.responseBody`	str
`properties.requestbody`	str
`relatedEvents`	array

category: Native field; inspect its exact type and nesting in the complete example below.
operationName: Native field; inspect its exact type and nesting in the complete example below.
correlationId: Native field; inspect its exact type and nesting in the complete example below.

Investigation uses

Review operationName, caller, status and correlationId for administrative changes.
Retain resource, account/project/subscription and region context for correlation.

Validation boundaries

Control-plane activity is different from resource data-plane access; export representations vary.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Azure Activity Log event schema - Azure Monitor | Microsoft Learn

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.