# Ensure that a 'Diagnostics Setting' exists for exporting activity logs

- Source: https://support.icompaas.com/support/solutions/articles/62000219823-ensure-that-a-diagnostics-setting-exists-for-exporting-activity-logs
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure CIS Benchmark Level 1 & Level 2](https://support.icompaas.com/support/solutions/62000112163) › [5. Logging and Monitoring](https://support.icompaas.com/support/solutions/folders/62000167548)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

Azure resources generate control-plane logs that record create, update, delete, policy changes, RBAC actions, and configuration updates. Diagnostic Settings must be configured to capture all supported control/management-plane categories and export them to Log Analytics, Storage Account, or Event Hub.

  

Rationale:

Missing diagnostic logs reduces visibility into administrative actions and configuration changes, impacting incident response, forensic investigations, and compliance. Exporting Activity Logs ensures long-term visibility and supports monitoring, auditing, and compliance requirements

  

Impact:

-   Enables long-term retention of Activity Logs
    
-   Improves detection and investigation of administrative and control-plane actions
    
-   Supports SIEMs like Microsoft Sentinel, Splunk, and QRadar
    
-   Required for CIS, NIST, SOC2, PCI, and ISO compliance
    

  

Default Value:

Control-plane logging is disabled by default unless manually configured.

  

Pre-requisites:

-   Log Analytics Workspace, Event Hub, or Storage Account must exist
    
-   Appropriate permissions, Microsoft.Insights/diagnosticSettings/\*, Subscription-level permissions (e.g., Owner, Contributor, Monitoring Contributor)
    

  

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Subscriptions
    
3.  Select the target subscription
    
4.  From the left menu, select Activity log
    
5.  Click Export Activity Logs
    
6.  Open Diagnostic settings
    
7.  Verify that at least one diagnostic setting exists
    
8.  Confirm Activity Logs are being exported to an approved destination
    
9.  Record the diagnostic setting name and destination as evidence
    

Implementation Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Subscriptions
    
3.  Select the target subscription
    
4.  From the left menu, select Activity log
    
5.  Click Export Activity Logs
    

![](https://support.icompaas.com/assets/kb/ed4c1382a363ad23.png)

6.  Click Add diagnostic setting
    

![](https://support.icompaas.com/assets/kb/0815eae25dd40498.png)

7.  Enter a name for the diagnostic setting
    
8.  Select Administrative, Security, ServiceHealth, Alert, and Policy logs
    
9.  Choose an export destination (Log Analytics workspace, Storage account, or Event Hub)
    

![](https://support.icompaas.com/assets/kb/dbcb34765fbfe355.png)

10.  Save the diagnostic setting
     

  

Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Open Subscriptions
    
3.  Select the target subscription
    
4.  Open Activity log
    
5.  Click Export Activity Logs
    
6.  Open Diagnostic settings
    
7.  Select the most recent diagnostic setting
    
8.  Click Delete
    
9.  Confirm the deletion
    

  

Reference:

-   [https://learn.microsoft.com/azure/azure-monitor/essentials/resource-logs](https://learn.microsoft.com/azure/azure-monitor/essentials/resource-logs)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.