Description:
Azure resources generate control-plane (management-plane) logs that capture administrative operations such as create, update, delete, policy enforcement, access changes, and configuration modifications. A Diagnostic Setting must be configured for each supported resource to capture these control-plane log categories and export them to a Log Analytics Workspace, Storage Account, or Event Hub. Enabling this ensures visibility into administrative activity across Azure resources.
Rationale:
If control-plane logging is not enabled, critical administrative operations may go unlogged. This prevents detection of unauthorized changes, hinders forensic investigations, weakens compliance, and creates gaps in audit trails. Capturing these logs is essential for monitoring configuration drift, identifying risky changes, and supporting governance and regulatory requirements.
Impact:
Ensures full visibility into administrative and configuration activities
Improves detection of unauthorized or suspicious management operations
Supports governance, monitoring, and compliance reporting
Enables SIEM ingestion (Sentinel, Splunk, QRadar) for audit and security analysis
Provides evidence for forensic investigations during security incidents
Default Value:
Most Azure services have no Diagnostic Settings enabled by default. Manual configuration is required.
Pre-Requisites:
Log Analytics Workspace, Storage Account, or Event Hub must exist
Access permissions, Microsoft.Insights/diagnosticSettings/*, Read permissions on the resource
Review of supported log categories per resource type
Test Plan:
Sign in to the Azure Portal at https://portal.azure.com
Open Subscriptions
Select the target subscription
From the left menu, select Activity log
Click Export Activity Logs
Open Diagnostic settings
Select the diagnostic setting, and click on edit settings.
Verify Administrative, Security, ServiceHealth, Alert, and Policy logs are enabled
Confirm that the diagnostic setting is enabled and exporting logs
If the required categories are not enabled, follow the implementation steps
Implementation Steps:
Sign in to the Azure Portal at https://portal.azure.com
Open Subscriptions
Select the target subscription
From the left menu, select Activity log
Click Export Activity Logs
Click Add diagnostic setting
Enter a name for the diagnostic setting
Enable Administrative, Security, ServiceHealth, Alert, and Policy logs
Select an export destination (Log Analytics workspace, Storage account, or Event Hub)
Save the diagnostic setting
Backout Plan:
Sign in to the Azure Portal at https://portal.azure.com
Open Subscriptions
Select the target subscription
From the left menu, select Activity log
Click Export Activity Logs
Open Diagnostic settings
Select the diagnostic setting
Click Edit settings
Disable the previously enabled log categories
Save the diagnostic setting
Reference: