Use Azure Activity Log to investigate management operations such as resource changes and deployment errors. It is collected automatically and retained for 90 days; data-plane activity requires separate resource logging.
Before you begin
Use an account with access at the scope you need. Monitoring Reader can query the Activity Log; ask an administrator for an appropriately scoped assignment if access is missing.
Find the events
- Sign in to Azure portal. Open Monitor > Activity log and select the subscription, or open Activity log from a particular resource.
- Set Timespan to cover the period you are investigating.
- Select Add Filter to narrow by resource, operation, event category or initiating identity.
- Open a relevant event. Where available, inspect Change history for associated resource changes.
- Select Download as CSV to save the filtered log.
Check the export
Open the CSV and confirm its scope and timestamps match your investigation. Record the filters and time range alongside the file so another administrator can repeat the check.
If the download fails
A CSV preparation or file-not-found error can result from requesting too many events. Reduce the time range and retry in smaller batches. If the problem continues, clear the browser cache and try again.
For very recent activity, allow for the usual 3–20 minute collection delay. Plan a diagnostic setting if you need retention beyond 90 days.
