Overview
In any Azure environment, true visibility is the foundation of security, governance, and cost management. Azure operates with a control plane that manages all resources—creating, modifying, and deleting them. The definitive record of every action taken against this control plane is the Azure Activity Log. It answers the critical questions of who did what, when, and from where.
However, simply enabling the Activity Log is not enough. A common and dangerous gap exists when the log export configuration is incomplete. To achieve full visibility, you must ensure that three specific categories of administrative operations are captured: Write, Delete, and Action.
Failing to capture all three categories creates critical blind spots. It leaves your security teams unable to detect unauthorized configuration changes, your operations teams struggling to diagnose outages, and your FinOps practice unable to attribute changes to the correct owners. This article explains why comprehensive Activity Log configuration is a non-negotiable baseline for any secure and well-governed Azure environment.
Why It Matters for FinOps
For FinOps practitioners, an incomplete audit trail is more than a security issue; it’s a financial and operational risk. When administrative actions aren’t logged, the ability to practice effective cloud financial management is severely undermined.
Without a complete log of all Write, Delete, and Action events, you lose the ability to perform accurate showback or chargeback, as you cannot definitively prove which team or project initiated a resource change. This lack of data integrity also complicates efforts to optimize spending, as the root cause of unexpected cost spikes—such as the creation of expensive resources or changes to configurations—is hidden. Furthermore, audit failures stemming from inadequate logging can result in significant financial penalties from regulatory bodies, directly impacting the bottom line.
What Counts as “Idle” in This Article
In the context of this article, we define an "idle" system not as an unused virtual machine, but as an idle audit trail. Your logging and monitoring framework is considered idle if it is not actively capturing the full spectrum of control plane events, creating a dangerous illusion of security.
An idle audit trail gives a false sense of visibility while critical events go unrecorded. The primary signals of this idleness are gaps in your exported Azure Activity Log data. If your logs are missing any of the following event categories, your visibility is incomplete:
- Write Events: The creation of new resources or modification of existing ones.
- Delete Events: The permanent removal of resources.
- Action Events: Privileged operations that don’t change a resource but can expose data, such as listing storage account access keys.
Common Scenarios
These logging gaps often appear unintentionally in specific operational contexts.
Scenario 1
An engineering team adopts Infrastructure as Code (IaC) using ARM templates or Terraform. A developer uses a common template that only specifies logging for "Write" events, assuming it covers all changes. The deployment succeeds, but now all resource deletions and privileged actions are happening silently, without a trace in the centralized security monitoring system.
Scenario 2
A large enterprise manages hundreds of Azure subscriptions. A central governance policy enforces comprehensive logging on production environments, but the policy is not applied to development and testing subscriptions. An attacker compromises a developer’s credentials, uses that access to list production keys from a dev environment (an "Action" event), and exfiltrates data, all without triggering an alert because the action was never logged.
Scenario 3
A business unit outside of central IT manually configures a log export profile. To "reduce noise" or save on storage costs, the user deselects the "Action" category, not understanding its security implications. They have inadvertently disabled the primary mechanism for detecting credential theft and data access attempts.
Risks and Trade-offs
The primary trade-off organizations consider is between comprehensive logging and the perceived complexity or cost of storing that data. However, the risks associated with incomplete logging far outweigh the costs. Failing to log all critical activities means you cannot reliably detect or respond to security incidents.
In the event of a breach, incident response teams depend on a complete timeline. Without "Delete" logs, they may waste valuable time searching for a malicious resource that an attacker has already removed. Without "Action" logs, they will never know if sensitive data keys were accessed. This not only delays resolution but also makes it impossible to determine the full scope of a data breach, leading to compliance failures and reputational damage.
Recommended Guardrails
To prevent logging gaps and enforce a state of continuous compliance, organizations should implement automated governance guardrails rather than relying on manual processes.
Tagging and ownership policies are foundational, ensuring every resource change can be attributed to a team. Building on this, you should establish a clear policy that mandates the logging of "Write," "Delete," and "Action" categories for all subscriptions. Use Azure Policy to automatically audit for this configuration and, where possible, use "DeployIfNotExists" policies to remediate non-compliant settings automatically. This ensures that even environments created outside of standard pipelines are brought into compliance, preventing configuration drift and maintaining a complete audit trail across the entire Azure estate.
Provider Notes
Azure
The core service for this capability is the Azure Activity Log, which provides a record of subscription-level events. To ensure these logs are retained and analyzed, you must configure them to be exported. While legacy Log Profiles were used for this, the modern and recommended approach is to use Diagnostic Settings at the subscription level. When configuring Diagnostic Settings for the Activity Log, selecting the "Administrative" category ensures that Write, Delete, and Action events are captured. To enforce this configuration at scale, use Azure Policy to audit and remediate any subscriptions lacking the proper settings.
Binadox Operational Playbook
Binadox Insight: An incomplete audit log is often more dangerous than no audit log at all. It creates a false sense of security, causing teams to believe they have visibility while attackers operate undetected in the blind spots you’ve unintentionally created.
Binadox Checklist:
- Audit all Azure subscriptions to ensure Activity Log exports are configured.
- Verify that legacy Log Profiles or modern Diagnostic Settings capture "Write," "Delete," and "Action" events (often grouped as "Administrative").
- Automate the enforcement of this logging configuration using Azure Policy.
- Ensure logs are routed to a secure, centralized storage account or SIEM for long-term retention and analysis.
- Regularly review access policies for the storage location where logs are kept.
- Establish an alerting strategy for high-severity events, especially from the "Action" category.
Binadox KPIs to Track:
- Percentage of Subscriptions with Compliant Logging: Track the coverage of your logging policy across the entire Azure environment.
- Mean Time to Detect (MTTD): Measure the time it takes for your security tools to alert on a non-compliant configuration change.
- Number of Logging Policy Violations: Monitor the frequency of non-compliant configurations being created to identify gaps in training or automation.
- Audit Pass/Fail Rate: Track the success rate of internal and external audits related to logging and monitoring controls.
Binadox Common Pitfalls:
- Assuming IaC Defaults are Secure: Infrastructure as Code templates often require explicit configuration for all log categories; never assume the default settings are comprehensive.
- Neglecting Non-Production Environments: Attackers often target less-monitored dev/test environments to find credentials or pivot to production. Enforce consistent logging everywhere.
- Misunderstanding "Action" Events: Overlooking the "Action" category is a critical error, as it’s the primary way to detect privileged operations like the retrieval of access keys.
- Setting and Forgetting: Without continuous monitoring via a tool like Azure Policy, configurations can and will drift from the secure baseline.
Conclusion
Ensuring your Azure Activity Log captures all "Write," "Delete," and "Action" events is a foundational pillar of cloud security and financial governance. Leaving these gaps open is an invitation for undetected threats and creates significant operational friction.
By implementing automated guardrails with Azure Policy and fostering an organizational understanding of these risks, you can move from a reactive to a proactive security posture. A complete, reliable audit trail is not a luxury—it is an essential control for operating securely and efficiently in Azure.
7-day free trial