---
title: Azure activity logs
description: Export Azure subscription activity logs to an Event Hub and forward them to Coralogix with the Event Hub integration.
url: https://coralogix.com/docs/integrations/azure/azure-activity-logs/
product: ingress
feature: Azure Logs Ingress
feature_id: logs.azure-ingress
feature_identifier: ingress/logs.azure-ingress
last_updated: '2026-09-03'
---

# Azure activity logs

[Activity logs](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log) are the audit trail of operations performed *on* the resources in a subscription, creations, deletions, and updates. That is the management plane, as distinct from the [resource logs](https://coralogix.com/docs/integrations/azure/azure-resource-logs.md) that record what happens inside a resource.

Collection takes two moves: an export that streams the activity log to an Event Hub, and the [Event Hub integration](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md) that forwards from there.

## What you need

* An Azure account with an active subscription.
* An Event Hub namespace. If yours restricts public access, enable VNet support first. See the [optional configuration steps](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md).

## Export the activity log

1

<!-- -->

.

Open the export

Navigate to your **Subscription**, then **Activity log**, then select **Export Activity Logs**.

2

<!-- -->

.

Add a diagnostic setting

Select **Add diagnostic setting** and give it a name.

3

<!-- -->

.

Pick the categories and destination

Select the categories you want. **Administrative**, **Security**, **ServiceHealth**, **Alert**, **Recommendation**, **Policy**, **Autoscale**, and **ResourceHealth**. Under **Destination details**, select **Stream to an event hub** and choose your subscription, namespace, event hub, and policy. Select **Save**.

[![Azure Diagnostic setting page with all activity log categories selected and Stream to an event hub configured](/docs/assets/images/Untitled-29-b0c48adbcdd567a70afe096f3828692f.webp)](https://coralogix.com/docs/assets/images/Untitled-29-b0c48adbcdd567a70afe096f3828692f.webp)

Shows the eight activity log categories alongside the Event Hub destination they stream to.

## Forward from the Event Hub

Deploy the Azure Event Hub integration to collect the messages and submit them to Coralogix. Two deployment paths are available:

| Path                                                                                                                              | Use                         |
| --------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| [Azure Event Hub ARM](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md)                | Deploy from an ARM template |
| [ARM Event Hub integration package](https://coralogix.com/docs/integrations/azure/azure-resource-manager-integration-packages.md) | Deploy the packaged version |
| [Azure Event Hub Terraform](https://coralogix.com/docs/integrations/azure/azure-event-hub-terraform-module.md)                    | Deploy with Terraform       |

## Related resources

[Introduction to Microsoft Azure](https://coralogix.com/docs/integrations/azure/introduction-to-microsoft-azure.md)[Azure resource logs](https://coralogix.com/docs/integrations/azure/azure-resource-logs.md)[Optional Azure configurations](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md)