Blog Post

Microsoft Sentinel Blog
2 MIN READ

Moving Azure Activity Connector to an improved method

ShaharAviv's avatar
ShaharAviv
Icon for Microsoft rankMicrosoft
Jun 24, 2021
The Activity log is a platform log in Azure that provides insight into subscription-level events. This includes such information as when a resource is modified or when a virtual machine is started. Y...
Updated Jun 24, 2021
Version 2.0
ShaharAviv's avatar
Icon for Microsoft rankMicrosoft
Joined February 28, 2021
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

SocInABox's avatar
SocInABox
Iron Contributor
Oct 23, 2023

hi ShaharAviv , I have some questions about the 'new' way to collect Azure Activity logs using Azure Policy.

 

The 'new' way:

Sentinel > Azure Activity Log Connector > create a policy to pull the logs.

 

Please confirm my assumptions below:


- It is NOT recommended to assign a policy at the root tenant level - this will fail unless you apply additional roles to the global admin. You should use subscription groups and not the root subscription - correct?

- It IS recommended to assign this policy at either a subscription level or a subscription group level - correct?

- For any existing subscriptions you may need to apply a remediation as the policy will only apply to NEW resources - correct?

 

In some cases I've created an Azure Policy and it shows it 'failed compliance' because there are no matching resources in the subscription - why does this happen? I expect this policy to simply log all azure activity under the scope of 1 or more subscriptions.

 

Thanks!