Subscription has an Activity Log diagnostic setting

Check ID: monitor_diagnostic_settings_exists
Provider: Azure
Service: monitor
Severity: HIGH
Categories: logging
Resource type: microsoft.resources/subscriptions

What this check verifies

Azure Monitor Diagnostic Settings are configured to export the Activity Log to an external destination (Log Analytics, Storage, Event Hub, or partner).

Risk

Without exporting the Activity Log, control-plane events lack centralization and retention. Undetected RBAC changes, policy updates, and resource deletions reduce detectability, hinder forensics, and weaken incident response and audit evidence.

Recommendation

Enable subscription Diagnostic Settings to send the Activity Log to a trusted destination. Use immutable storage or a SIEM, enforce coverage with Azure Policy, apply least privilege to log access, include essential categories, and set retention aligned to regulatory needs.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az monitor diagnostic-settings subscription create --subscription <subscription id> --name <example_resource_name> --workspace <log analytics workspace ID> --logs '[{"category":"Administrative","enabled":true}]'

# Subscription-level Activity Log diagnostic setting
resource "azurerm_monitor_diagnostic_setting" "<example_resource_name>" {
  name                       = "<example_resource_name>"
  target_resource_id         = "/subscriptions/<subscription id>" # CRITICAL: subscription scope
  log_analytics_workspace_id = "<example_resource_id>"             # CRITICAL: destination workspace

  log {
    category = "Administrative"   # CRITICAL: enable at least one Activity Log category
    enabled  = true
  }
}

// Subscription-level Activity Log diagnostic setting
resource diag 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: '<example_resource_name>'
  scope: subscription() // CRITICAL: targets the subscription Activity Log
  properties: {
    workspaceId: '<example_resource_id>' // CRITICAL: sends logs to this Log Analytics workspace
    logs: [
      { category: 'Administrative', enabled: true } // CRITICAL: enables at least one Activity Log category
    ]
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_diagnostic_settings_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Diagnostic setting captures all required log categories Activity Log storage account uses a customer-managed key

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires