Get-AzSubscriptionActivityLog retrieves events from the Activity Log in an Azure subscription using the REST API. Caller identities are translated to their friendly names from their GUIDs. Requires the Az.Accounts module for authentication in the current context.
Note by default, operations with 'List' or 'Get token' in the name are excluded from the results as these can be numerous. To include them, use the -IncludeListAndGetOperations parameter
Permissions
Requires at least a Reader role in the Azure subscription.
Requires Directory.Read.All permission in Microsoft Graph.
This command gets events where the calling identity is either Windows 365 or Microsoft.RecoveryServices. You could also specify the displayname of a managed identity or the UPN of a AAD user.
Example 5 - Get activity log events with a specific severity
This command gets events where the resourceId matches the string VM001, which in this case is a virtual machine name. This could be any part of the resourceId name after the resource provider and supports a single string only.
Example 9 - Get activity log events for a specific resource type
This command groups events by their category and displays the counts of each category with the most numerous first.
Parameters
-TenantId
Required. GUID as a String. The tenant Id for the Azure subscription.
-SubscriptionId
Required. GUID as a String. The Azure subscription Id.
TimespanHours
Integer. The number of hours past (from now) to retrieve events. Default is 6.
IncludeProperties
Switch. Use this parameter to include the additional properties for the event. Each event may have additional properties that differ depending on the event type.
IncludeListAndGetOperations
Switch. By default, operations with "List" or "Get token" in the name are excluded as they can be numerous and aren't always useful. Add this parameter if you wish to include them instead.
IdentityType
String[]. The identity type of the caller. Valid values are Application, ManagedIdentity, Service,User or $null.
Level
String[]. The event level or severity. Valid values are Informational, Warning, Error or Critical.
Category
String[]. The event category, for example Administrative, Security, Policy, Recommendation
Caller
String[]. The identity that performed the action in the event.
ResourceGroupName
String[]. The name of one or more resource groups to filter on.
ResourceProviderName
String[]. One or more resource providers to filter on, such as Microsoft.Compute or Microsoft.RecoveryServices
ResourceIdMatch
String. Use this to search for a resource by name using a match, for example a VM name or a NIC name.
ResourceType
String[]. One or more resource types to filter on, for example Microsoft.Network/networkInterfaces or Microsoft.HybridCompute/machines/extensions
OperationName
String[]. The localized values of one or more operation names, for example "Create or Update Network Interface" or "Backup Protected Item"
Status
String[]. The event status. Valid values are Accepted, Started, Succeeded, Failed.
