Change Analysis in Azure Resource Graph: Your first stop for “What changed?”

 

Introduction

One of the most common questions during Azure networking troubleshooting is:

“Did anything change before the issue started?”

Whether we are investigating VPN/, connectivity problems, Azure Firewall behavior changes, VM outages, routing issues, or application failures, identifying recent configuration changes is often the fastest way to determine the root cause.

Change Analysis is a powerful capability built on Azure Resource Graph that allows engineers and administrators to quickly see:

• What changed
• When the change occurred
• Who made the change
• Which client or tool performed the change
• The exact configuration differences before and after the change

 

 

What is Change Analysis?

Azure resources are constantly being modified through:

• Azure portal
• Azure CLI
• PowerShell
• ARM/Bicep deployments
• Terraform
• Azure Policy remediation
• Automation runbooks
• CI/CD pipelines

In many organizations, multiple administrators and engineers have access to the same Azure tenant and subscriptions. Because teams often work across different regions and time zones, it can be difficult to determine who made a change and to quickly contact the responsible person when an issue occurs. While most changes are intentional and necessary for daily operations, some modifications can unintentionally introduce outages, connectivity issues, or performance problems. Azure Change Analysis provides a centralized view of resource changes and helps organizations quickly answer critical troubleshooting questions such as: Who changed a setting? Was a route table updated before traffic stopped flowing? Did someone modify an NSG rule? Was the Azure Firewall configuration changed? When was a virtual machine resized? By showing what changed, when it changed, and who made the change, Change Analysis significantly reduces troubleshooting time and helps accelerate root cause analysis.

 

How Change Analysis works

When an Azure resource is:

• Created
• Updated
• Deleted

 Azure Resource Graph captures change information and stores snapshots that can later be queried.

The platform records:

This dramatically reduces troubleshooting time because engineers can immediately identify configuration drift or recent modifications.

 

Accessing Change Analysis in Azure portal

As shown in the screenshot, Change Analysis can be accessed directly from the Azure portal.

 

Navigation options

Global Change Analysis view

1. Open Azure portal
2. Search for Change Analysis
3. Select Change Analysis

This approach is particularly useful when troubleshooting a specific service such as:

• VPN Gateway
• Azure Firewall
• Virtual Machine
• Load Balancer
• Application Gateway
• Network security group (NSG)

 

Compare old and new configuration

• View the exact configuration changes made to a resource.
• Compare Old Configuration (left panel) with New Configuration (right panel).
• Identify added, removed, or modified properties.
• Review configuration differences at the property level.
• Quickly determine what changed during the incident timeframe.
• Useful for analyzing:
• NSG rule additions or deletions
• Route table modifications
• Azure Firewall rule changes
• VPN Gateway configuration updates
• Public IP changes
• Resource property updates

Example: In the screenshot above, Change Analysis clearly shows the previous NSG rule configuration on the left and the updated configuration on the right, making it easy to identify exactly which rule was added, modified, or removed. This helps engineers quickly correlate configuration changes with service disruptions and accelerate root cause analysis.

 

 

 

 

Common Azure networking use cases

As an Azure networking some practical scenarios include:

VPN Gateway troubleshooting

VPN down

• Modified Local Network Gateway prefixes
• BGP ASN changes
• Tunnel configuration updates
• Public IP changes
• IKE parameter

Azure Firewall investigation

A workload suddenly loses connectivity.

Change Analysis may show:

• DNAT rule modification
• Network Rule change
• Application Rule update

NSG connectivity problems

When VM traffic is blocked unexpectedly, Change Analysis can identify:

• Newly added deny rules
• Priority changes
• Rule deletions

Route table changes

Change Analysis quickly exposes:

• Next-hop modifications
• UDR updates
• Route propagation changes

 

Querying changes using Azure Resource Graph

 

 

Azure Portal → Monitor → Change Analysis →Open query  →Azure Resource Graph Explorer.

 

resourcechanges

|extend timestamp = todatetime(properties.changeAttributes.timestamp)

|where timestamp > ago(24h)

|extend resourceType = properties.targetResourceType

|extend resourceId = properties.targetResourceId

|extend changeType = properties.changeType

|extend changeAttributes = parse_json(properties.changeAttributes)

|where resourceId in ('-----------')

|project id, timestamp, subscriptionId, resourceGroup, resourceId, resourceType, changeType, changeAttributes

|order by timestamp desc

 

 

 

 

Conclusion

Change Analysis has become one of the most valuable troubleshooting tools available in Azure. By providing visibility into who changed what and when, it helps engineers quickly identify configuration drift, reduce mean time to resolution, and accelerate root cause analysis.

For Azure networking scenarios such as VPN Gateway, ExpressRoute, Azure Firewall, Route Tables, and NSGs, Change Analysis should be one of the very first tools consulted when investigating unexpected behavior.

As every Azure support engineer knows, solving an incident often starts with a simple question:

“What changed?”

Change Analysis helps answer that question in seconds