Azure Kusto Query Language hot tip: Finding out who deleted locks

The locks feature in Microsoft Azure is important to protect provisioned resources and should be monitored accordingly. We can use Azure Kusto Query Language to retrieve the last successful attempts of locks deletion in a few lines.

The result of the query that we will be working on today is depicted in the image below, where we can spot in a single glance the most important questions that we need to investigate/audit locks. They are: when, who, and what was deleted.

The query required to provide that output is listed below.

AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue == 'MICROSOFT.AUTHORIZATION/LOCKS/DELETE'
| where ActivityStatusValue == 'Success'
| order by TimeGenerated desc
| project  TimeGenerated, Caller, ResourceProviderValue, resource = parse_json(Properties).resource, SubscriptionId, ResourceGroup, OperationNameValue,  ActivityStatusValue, ActivitySubstatusValue

 

Leave a Comment

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top