# Azure activity logs

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fazure%2Fazure-activity-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fazure%2Fazure-activity-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

[Activity logs](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log) are the audit trail of operations performed *on* the resources in a subscription, creations, deletions, and updates. That is the management plane, as distinct from the [resource logs](https://coralogix.com/docs/integrations/azure/azure-resource-logs.md) that record what happens inside a resource.

Collection takes two moves: an export that streams the activity log to an Event Hub, and the [Event Hub integration](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md) that forwards from there.

## What you need [​](#what-you-need- "Direct link to what-you-need-")

* An Azure account with an active subscription.
* An Event Hub namespace. If yours restricts public access, enable VNet support first. See the [optional configuration steps](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md).

## Export the activity log [​](#export-the-activity-log- "Direct link to export-the-activity-log-")

1

<!-- -->

.

Open the export

Navigate to your **Subscription**, then **Activity log**, then select **Export Activity Logs**.

2

<!-- -->

.

Add a diagnostic setting

Select **Add diagnostic setting** and give it a name.

3

<!-- -->

.

Pick the categories and destination

Select the categories you want. **Administrative**, **Security**, **ServiceHealth**, **Alert**, **Recommendation**, **Policy**, **Autoscale**, and **ResourceHealth**. Under **Destination details**, select **Stream to an event hub** and choose your subscription, namespace, event hub, and policy. Select **Save**.

[![Azure Diagnostic setting page with all activity log categories selected and Stream to an event hub configured](/docs/assets/images/Untitled-29-b0c48adbcdd567a70afe096f3828692f.webp)](https://coralogix.com/docs/assets/images/Untitled-29-b0c48adbcdd567a70afe096f3828692f.webp)

Shows the eight activity log categories alongside the Event Hub destination they stream to.

## Forward from the Event Hub [​](#forward-from-the-event-hub- "Direct link to forward-from-the-event-hub-")

Deploy the Azure Event Hub integration to collect the messages and submit them to Coralogix. Two deployment paths are available:

| Path                                                                                                                              | Use                         |
| --------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| [Azure Event Hub ARM](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md)                | Deploy from an ARM template |
| [ARM Event Hub integration package](https://coralogix.com/docs/integrations/azure/azure-resource-manager-integration-packages.md) | Deploy the packaged version |
| [Azure Event Hub Terraform](https://coralogix.com/docs/integrations/azure/azure-event-hub-terraform-module.md)                    | Deploy with Terraform       |

## Related resources[​](#related-resources "Direct link to Related resources")

[Introduction to Microsoft Azure](https://coralogix.com/docs/integrations/azure/introduction-to-microsoft-azure.md)[Azure resource logs](https://coralogix.com/docs/integrations/azure/azure-resource-logs.md)[Optional Azure configurations](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md)