Q22 Monitor Domain 4 · 20–25% of exam

Which Log Analytics table stores Azure Activity Log events (Azure control plane operations)?

  1. A AzureDiagnostics
  2. B AuditLogs
  3. C AzureActivity (correct answer)
  4. D SecurityEvent

Shortcut: AzureActivity contains Activity Log events: CRUD operations on Azure resources, policy evaluations, service health events. Query it to investigate who created, modified, or deleted a resource.