CINXE.COM

<!DOCTYPE html><html class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light" lang="en-us" dir="ltr" data-authenticated="false" data-auth-status-determined="false" data-target="docs" x-ms-format-detection="none"> <head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta property="og:title" content="Send Azure activity log data - Azure Monitor" /> <meta property="og:type" content="website" /> <meta property="og:url" content="https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log" /><meta property="og:description" content="Send Azure Monitor activity log data to Azure Monitor Logs, Azure Event Hubs, and Azure Storage." /><meta property="og:image" content="https://learn.microsoft.com/en-us/media/open-graph-image.png" /> <meta property="og:image:alt" content="Microsoft Learn" /> <meta name="twitter:card" content="summary_large_image" /> <meta name="twitter:site" content="@MicrosoftLearn" /> <meta name="color-scheme" content="light dark"><meta name="author" content="guywi-ms" /> <meta name="breadcrumb_path" content="../../breadcrumb/azure-monitor/toc.json" /> <meta name="depot_name" content="Learn.azure-monitor" /> <meta name="description" content="Send Azure Monitor activity log data to Azure Monitor Logs, Azure Event Hubs, and Azure Storage." /> <meta name="document_id" content="1a41bb29-78cd-d42d-65ba-28208a4af1b6" /> <meta name="document_version_independent_id" content="1af32d67-e3d5-a6dc-ed89-49170804fd17" /> <meta name="feedback_help_link_type" content="get-help-at-qna" /> <meta name="feedback_help_link_url" content="https://learn.microsoft.com/answers/tags/20/azure-monitor/" /> <meta name="feedback_product_url" content="https://feedback.azure.com/d365community/forum/3887dc70-2025-ec11-b6e6-000d3a4f09d0" /> <meta name="feedback_system" content="Standard" /> <meta name="git_commit_id" content="de33c67ba52b3e475561176b5decc8dd65fd9326" /> <meta name="gitcommit" content="https://github.com/MicrosoftDocs/azure-monitor-docs-pr/blob/de33c67ba52b3e475561176b5decc8dd65fd9326/articles/azure-monitor/essentials/activity-log.md" /> <meta name="interactive_type" content="azurecli" /> <meta name="learn_banner_products" content="azure" /> <meta name="locale" content="en-us" /> <meta name="manager" content="orspodek" /> <meta name="ms.author" content="guywild" /> <meta name="ms.date" content="12/11/2023" /> <meta name="ms.reviewer" content="orens" /> <meta name="ms.service" content="azure-monitor" /> <meta name="ms.subservice" content="essentials" /> <meta name="ms.suite" content="office" /> <meta name="ms.topic" content="conceptual" /> <meta name="original_content_git_url" content="https://github.com/MicrosoftDocs/azure-monitor-docs-pr/blob/live/articles/azure-monitor/essentials/activity-log.md" /> <meta name="page_type" content="conceptual" /> <meta name="permissioned-type" content="public" /> <meta name="recommendation_types" content="Training" /> <meta name="recommendation_types" content="Certification" /> <meta name="recommendations" content="true" /> <meta name="schema" content="Conceptual" /> <meta name="services" content="azure-monitor" /> <meta name="site_name" content="Docs" /> <meta name="toc_rel" content="../toc.json" /> <meta name="uhfHeaderId" content="azure" /> <meta name="updated_at" content="2025-02-06 06:01 PM" /> <meta name="word_count" content="2047" /> <meta name="persistent_id" content="39723f33-0761-c38c-a568-d7ed0abbe65e" /> <meta name="platform_id" content="39723f33-0761-c38c-a568-d7ed0abbe65e" /> <meta name="cmProducts" content="https://authoring-docs-microsoft.poolparty.biz/devrel/07bb3e10-d135-43ff-bc8b-360497cb39fa" data-source="generated" /> <meta name="cmProducts" content="https://authoring-docs-microsoft.poolparty.biz/devrel/68ec7f3a-2bc6-459f-b959-19beb729907d" data-source="generated" /> <meta name="cmProducts" content="https://authoring-docs-microsoft.poolparty.biz/devrel/f0234678-3067-4edc-abf7-8142d54bb7d2" data-source="generated" /> <meta name="spProducts" content="https://authoring-docs-microsoft.poolparty.biz/devrel/12e559b9-eaf6-4aee-9af7-62334e15f863" data-source="generated" /> <meta name="spProducts" content="https://authoring-docs-microsoft.poolparty.biz/devrel/90370425-aca4-4a39-9533-d52e5e002a5d" data-source="generated" /> <meta name="spProducts" content="https://authoring-docs-microsoft.poolparty.biz/devrel/b0f4f6b9-28ed-4892-be4e-517310289c68" data-source="generated" /> <meta name="scope" content="Azure, Azure Monitor" /><meta name="github_feedback_content_git_url" content="https://github.com/MicrosoftDocs/azure-monitor-docs/blob/main/articles/azure-monitor/essentials/activity-log.md" /><link href="https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log" rel="canonical"><title>Send Azure activity log data - Azure Monitor | Microsoft Learn</title><link rel="stylesheet" href="/static/assets/0.4.029716302/styles/site-ltr.css"> <script id="msdocs-script"> var msDocs = {environment: { supportLevel: 'production', accessLevel: 'online', reviewFeatures: false, systemContent: true, azurePortalHostname: 'portal.azure.com', legacyHosting: false, siteName: 'learn', },data: { timeOrigin: Date.now(), contentLocale: 'en-us', contentDir: 'ltr', userLocale: 'en-us', userDir: 'ltr', pageTemplate: 'Conceptual', brand: 'azure', context: {}, hasBinaryRating: true, feedbackHelpLinkType:'get-help-at-qna', feedbackHelpLinkUrl:'https://learn.microsoft.com/answers/tags/20/azure-monitor/', standardFeedback: true, showFeedbackReport: false, enableTutorialFeedback: false, feedbackSystem: 'Standard', feedbackGitHubRepo: 'MicrosoftDocs/azure-docs', feedbackProductUrl: 'https://feedback.azure.com/d365community/forum/3887dc70-2025-ec11-b6e6-000d3a4f09d0',extendBreadcrumb: false,isEditDisplayable: true, hideViewSource: false, hasPageActions: true, hasPrintButton: true, hasBookmark: true, hasShare: true, isPermissioned: false, isPrivateUnauthorized: false,hasRecommendations: true,contributors: [{ name: "guywi-ms", url: "https://github.com/guywi-ms" },{ name: "ynakajima9", url: "https://github.com/ynakajima9" },{ name: "EdB-MSFT", url: "https://github.com/EdB-MSFT" },{ name: "prmerger-automator[bot]", url: "https://github.com/prmerger-automator[bot]" },{ name: "osalzberg", url: "https://github.com/osalzberg" },{ name: "ManoharLakkoju-MSFT", url: "https://github.com/ManoharLakkoju-MSFT" },{ name: "nicolas-kuyumciyan-tracebit", url: "https://github.com/nicolas-kuyumciyan-tracebit" },{ name: "AbbyMSFT", url: "https://github.com/AbbyMSFT" },{ name: "KennedyDenMSFT", url: "https://github.com/KennedyDenMSFT" },{ name: "v-jbasden", url: "https://github.com/v-jbasden" },{ name: "jefffanjoy", url: "https://github.com/jefffanjoy" },{ name: "hhunter-ms", url: "https://github.com/hhunter-ms" },{ name: "nconvery", url: "https://github.com/nconvery" },{ name: "DaleKoetke", url: "https://github.com/DaleKoetke" },{ name: "JasonAndrewWriter", url: "https://github.com/JasonAndrewWriter" },{ name: "cmcclister", url: "https://github.com/cmcclister" },{ name: "v-rajagt", url: "https://github.com/v-rajagt" },{ name: "jurajsucik", url: "https://github.com/jurajsucik" },{ name: "rboucher", url: "https://github.com/rboucher" },{ name: "bwren", url: "https://github.com/bwren" },{ name: "DCtheGeek", url: "https://github.com/DCtheGeek" }],}, functions:{} }; </script><script src="https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js"></script> <script src="https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js"></script><script src="/static/assets/0.4.029716302/global/deprecation.js"></script><script src="/static/assets/0.4.029716302/scripts/en-us/index-docs.js"></script></head> <body lang="en-us" dir="ltr"> <div class="header-holder has-default-focus"> <a href="#main" style="z-index: 1070" class="outline-color-text visually-hidden-until-focused position-fixed inner-focus focus-visible top-0 left-0 right-0 padding-xs text-align-center has-body-background" tabindex="1">Skip to main content</a><div hidden id="cookie-consent-holder" data-test-id="cookie-consent-container"></div> <div id="unsupported-browser" style=" background-color: white; color: black; padding: 16px; border-bottom: 1px solid grey;" hidden > <div style="max-width: 800px; margin: 0 auto;"> <p style="font-size: 24px">This browser is no longer supported.</p> <p style="font-size: 16px; margin-top: 16px;">Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.</p> <div style="margin-top: 12px;"> <a href="https://go.microsoft.com/fwlink/p/?LinkID=2092881 " style=" background-color: #0078d4; border: 1px solid #0078d4; color: white; padding: 6px 12px; border-radius: 2px; display: inline-block; ">Download Microsoft Edge</a> <a href="https://learn.microsoft.com/en-us/lifecycle/faq/internet-explorer-microsoft-edge" style=" background-color: white; padding: 6px 12px; border: 1px solid #505050; color: #171717; border-radius: 2px; display: inline-block; ">More info about Internet Explorer and Microsoft Edge</a> </div> </div> </div>   <header id="ms--site-header" data-test-id="site-header-wrapper" role="banner" itemscope="itemscope" itemtype="http://schema.org/Organization"> <div id="ms--mobile-nav" class="site-header display-none-tablet padding-inline-none gap-none" data-bi-name="mobile-header" data-test-id="mobile-header"></div> <div id="ms--primary-nav" class="site-header display-none display-flex-tablet" data-bi-name="L1-header" data-test-id="primary-header"></div> <div id="ms--secondary-nav" class="site-header display-none display-flex-tablet" data-bi-name="L2-header" data-test-id="secondary-header"></div> </header><div id="content-header" class="content-header uhf-container has-padding has-default-focus border-bottom-none" data-bi-name="content-header"> <div class="content-header-controls margin-xxs margin-inline-sm-tablet"> <button type="button" class="contents-button button button-sm margin-right-xxs" data-bi-name="contents-expand" aria-haspopup="true" data-contents-button> <span class="icon"><span class="docon docon-menu" aria-hidden="true"></span></span> <span class="contents-expand-title">Table of contents</span> </button> <button type="button" class="ap-collapse-behavior ap-expanded button button-sm" data-bi-name="ap-collapse" aria-controls="action-panel"> <span class="icon"><span class="docon docon-exit-mode" aria-hidden="true"></span></span> <span>Exit focus mode</span> </button> </div> </div><div id="disclaimer-holder" class="has-overflow-hidden has-default-focus">  </div> </div> <div class="mainContainer uhf-container has-default-focus" data-bi-name="body"> <div class="columns has-large-gaps is-gapless-mobile "><div id="left-container" class="left-container is-hidden-mobile column is-one-third-tablet is-one-quarter-desktop"> <nav id="affixed-left-container" class="margin-top-sm-tablet position-sticky display-flex flex-direction-column" aria-label="Primary"></nav> </div> <section class="primary-holder column is-two-thirds-tablet is-three-quarters-desktop">  <div class="columns is-gapless-mobile has-large-gaps "><div id="main-column" class="column is-full is-8-desktop"> <main id="main" class="" role="main" data-bi-name="content" lang="en-us" dir="ltr"> <div id="article-header" class="background-color-body margin-top-sm-tablet margin-bottom-xs display-none-print"> <div class="display-flex align-items-center "><details id="article-header-breadcrumbs-overflow-popover" class="popover" data-for="article-header-breadcrumbs"> <summary class="button button-clear button-primary button-sm inner-focus" aria-label="All breadcrumbs"> <span class="icon"> <span class="docon docon-more"></span> </span> </summary> <div id="article-header-breadcrumbs-overflow" class="popover-content padding-none"> </div> </details> <bread-crumbs id="article-header-breadcrumbs" data-test-id="article-header-breadcrumbs" class="overflow-hidden flex-grow-1 margin-right-sm margin-right-md-tablet margin-right-lg-desktop margin-left-negative-xxs padding-left-xxs"></bread-crumbs><div id="article-header-page-actions" class="opacity-none margin-left-auto display-flex flex-wrap-no-wrap align-items-stretch"><a id="lang-link-tablet" class="button button-primary button-clear button-sm display-none display-inline-flex-tablet" title="Read in English" data-bi-name="language-toggle" data-read-in-link hidden> <span class="icon margin-none" aria-hidden="true" data-read-in-link-icon> <span class="docon docon-locale-globe"></span> </span> <span class="is-visually-hidden" data-read-in-link-text>Read in English</span> </a><button type="button" class="collection button button-clear button-sm button-primary display-none display-inline-flex-tablet" data-list-type="collection" data-bi-name="collection" title="Add to collection"> <span class="icon margin-none" aria-hidden="true"> <span class="docon docon-circle-addition"></span> </span> <span class="collection-status is-visually-hidden">Save</span> </button><a data-contenteditbtn class="button button-clear button-sm text-decoration-none button-primary display-none display-inline-flex-tablet" aria-label="Edit" title="Edit This Document" data-bi-name="edit" href="https://github.com/MicrosoftDocs/azure-monitor-docs/blob/main/articles/azure-monitor/essentials/activity-log.md" data-original_content_git_url="https://github.com/MicrosoftDocs/azure-monitor-docs-pr/blob/live/articles/azure-monitor/essentials/activity-log.md" data-original_content_git_url_template="{repo}/blob/{branch}/articles/azure-monitor/essentials/activity-log.md" data-pr_repo="" data-pr_branch=""> <span class="icon margin-none" aria-hidden="true"> <span class="docon docon-edit-outline"></span> </span> </a> <details class="popover popover-right" id="article-header-page-actions-overflow"> <summary class="justify-content-flex-start button button-clear button-sm button-primary" aria-label="More actions" title="More actions"> <span class="icon" aria-hidden="true"> <span class="docon docon-more-vertical"></span> </span> </summary> <div class="popover-content padding-xs"><button data-page-action-item="overflow-mobile" type="button" class="justify-content-flex-start button-block button-sm has-inner-focus button button-clear display-none-tablet" data-bi-name="contents-expand" data-contents-button data-popover-close> <span class="icon"> <span class="docon docon-editor-list-bullet" aria-hidden="true"></span> </span><span class="contents-expand-title">Table of contents</span></button><a id="lang-link-overflow" class="justify-content-flex-start button-sm has-inner-focus button button-clear button-block display-none-tablet" title="Read in English" data-bi-name="language-toggle" data-page-action-item="overflow-mobile" data-check-hidden="true" data-read-in-link hidden > <span class="icon" aria-hidden="true" data-read-in-link-icon> <span class="docon docon-locale-globe"></span> </span> <span data-read-in-link-text>Read in English</span> </a><button type="button" class="collection justify-content-flex-start button button-clear button-sm has-inner-focus button-block display-none-tablet" data-list-type="collection" data-bi-name="collection" title="Save" data-page-action-item="overflow-mobile" data-check-hidden="true" data-popover-close> <span class="icon" aria-hidden="true"> <span class="docon docon-circle-addition"></span> </span> <span class="collection-status">Save</span> </button> <button type="button" class="collection justify-content-flex-start button button-clear button-sm has-inner-focus button-block display-none-tablet" data-list-type="plan" data-bi-name="plan" title="Add to plan" data-page-action-item="overflow-mobile" data-check-hidden="true" data-popover-close hidden> <span class="icon" aria-hidden="true"> <span class="docon docon-circle-addition"></span> </span> <span class="plan-status">Add to plan</span> </button><a data-contenteditbtn class="button button-clear button-block button-sm has-inner-focus justify-content-flex-start text-decoration-none display-none-tablet" aria-label="Edit" title="Edit This Document" data-bi-name="edit" href="https://github.com/MicrosoftDocs/azure-monitor-docs/blob/main/articles/azure-monitor/essentials/activity-log.md" data-original_content_git_url="https://github.com/MicrosoftDocs/azure-monitor-docs-pr/blob/live/articles/azure-monitor/essentials/activity-log.md" data-original_content_git_url_template="{repo}/blob/{branch}/articles/azure-monitor/essentials/activity-log.md" data-pr_repo="" data-pr_branch=""> <span class="icon" aria-hidden="true"> <span class="docon docon-edit-outline"></span> </span> <span>Edit</span> </a><div aria-hidden="true" class="margin-none" data-page-action-item="overflow-all"></div> <hr class="display-none-tablet margin-bottom-xxs margin-top-xxs" /> <h4 class="font-size-sm padding-left-xxs">Share via</h4> <a class="button button-clear button-sm button-block has-inner-focus text-decoration-none justify-content-flex-start share-facebook" data-bi-name="facebook" data-page-action-item="overflow-all"> <span class="icon" aria-hidden="true"> <span class="docon docon-facebook-share font-size-md color-primary"></span> </span> <span class="margin-left-xxs">Facebook</span> </a> <a class="button button-clear button-sm has-inner-focus button-block text-decoration-none justify-content-flex-start share-twitter" data-bi-name="twitter" data-page-action-item="overflow-all"> <span class="icon" aria-hidden="true"> <span class="docon docon-xlogo-share font-size-xxs"></span> </span> <span class="margin-left-xxs">x.com</span> </a> <a class="button button-clear button-sm has-inner-focus button-block text-decoration-none justify-content-flex-start share-linkedin" data-bi-name="linkedin" data-page-action-item="overflow-all"> <span class="icon" aria-hidden="true"> <span class="docon docon-linked-in-logo font-size-sm color-primary"></span> </span> <span class="margin-left-xxs">LinkedIn</span> </a> <a class="button button-clear button-sm button-block has-inner-focus text-decoration-none justify-content-flex-start margin-bottom-xxs share-email" data-bi-name="email" data-page-action-item="overflow-all"> <span class="icon" aria-hidden="true"> <span class="docon docon-mail-message font-size-sm color-primary"></span> </span> <span class="margin-left-xxs">Email</span> </a><hr /> <button class="button button-block button-clear button-sm justify-content-flex-start has-inner-focus margin-top-xxs" title="Print" type="button" aria-label="Print" data-bi-name="print" data-page-action-item="overflow-all" data-popover-close data-print-page data-check-hidden="true"> <span class="icon" aria-hidden="true"> <span class="docon docon-print font-size-sm color-primary"></span> </span> <span class="margin-left-xxs">Print</span> </button> </div> </details> </div></div> </div> <div> <button type="button" class="border contents-button button button-clear button-sm is-hidden-tablet has-inner-focus" data-bi-name="contents-expand" data-contents-button hidden> <span class="icon"> <span class="docon docon-editor-list-bullet" aria-hidden="true"></span> </span><span class="contents-expand-title">Table of contents</span></button> </div> <div class="content "><h1 id="send-azure-monitor-activity-log-data">Send Azure Monitor Activity log data</h1><div class="display-flex justify-content-space-between align-items-center flex-wrap-wrap page-metadata-container"> <div class="margin-right-xxs"> <ul class="metadata page-metadata" data-bi-name="page info" lang="en-us" dir="ltr"><li>Article</li><li class="visibility-hidden-visual-diff"><time class="is-invisible" data-article-date aria-label="Article review date" datetime="2024-09-11T16:50:00Z" data-article-date-source="calculated">09/11/2024</time> </li><li class="contributors-holder display-none-print"> <button type="button" class="contributors-button link-button" data-bi-name="contributors">21 contributors</button> </li></ul> </div> <div id="user-feedback" class="margin-block-xxs display-none-print" data-hide-on-archived> <button id="user-feedback-button" data-test-id="conceptual-feedback-button" class="button button-sm button-clear button-primary" type="button" data-bi-name="user-feedback-button" data-user-feedback-button > <span class="icon" aria-hidden="true"> <span class="docon docon-like"></span> </span> <span>Feedback</span> </button> </div></div><nav id="center-doc-outline" class="doc-outline is-hidden-desktop display-none-print margin-bottom-sm" data-bi-name="intopic toc" aria-label="In this article"> <h2 id="ms--in-this-article" class="title is-6 margin-block-xs">In this article</h2> </nav><p>The Azure Monitor Activity Log is a platform log that provides insight into subscription-level events. The Activity Log includes information like when a resource is modified or a virtual machine is started. You can view the Activity Log in the Azure portal or retrieve entries with PowerShell and the Azure CLI. This article provides information on how to view the Activity Log and send it to different destinations.</p> <p>Create a diagnostic setting to send the Activity Log to one or more of these locations:</p> <ul> <li><a href="#send-to-log-analytics-workspace" data-linktype="self-bookmark">Log Analytics workspace</a> for more complex querying and alerting</li> <li><a href="#send-to-azure-event-hubs" data-linktype="self-bookmark">Azure Event Hubs</a> to forwarding logs outside of Azure.</li> <li><a href="#send-to-azure-storage" data-linktype="self-bookmark">Azure Storage</a> for cheaper, long-term archiving.</li> </ul> <p>For details on how to create a diagnostic setting, see <a href="diagnostic-settings" data-linktype="relative-path">Create diagnostic settings to send platform logs and metrics to different destinations</a>.</p> <div class="TIP"> <p>Tip</p> <p>Send Activity Logs to a Log Analytics workspace for the following benefits:</p> <ul> <li>Sending logs to a Log Analytics workspace is free of charge for the default retention period.</li> <li>Send logs to a Log Analytics workspace for <a href="../logs/data-retention-configure" data-linktype="relative-path">longer retention of up to 12 years</a>.</li> <li>Logs exported to a Log Analytics workspace can be <a href="/en-us/power-bi/transform-model/log-analytics/desktop-log-analytics-overview" data-linktype="absolute-path">shown in Power BI</a></li> <li><a href="activity-log-insights" data-linktype="relative-path">Insights</a> are provided for Activity Logs exported to Log Analytics.</li> </ul> </div> <div class="NOTE"> <p>Note</p> <ul> <li>Entries in the Activity Log are system generated and can't be changed or deleted.</li> <li>Entries in the Activity Log are representing control plane changes like a virtual machine restart, any non related entries should be written into <a href="resource-logs" data-linktype="relative-path">Azure Resource Logs</a></li> <li>Entries in the Activity Log are typically a result of changes (create, update or delete operations) or an action having been initiated. Operations focused on reading details of a resource are not typically captured.</li> </ul> </div> <h2 id="send-to-log-analytics-workspace">Send to Log Analytics workspace</h2> <p>Send the activity log to a Log Analytics workspace to enable the <a href="../logs/data-platform-logs" data-linktype="relative-path">Azure Monitor Logs</a> feature, where you:</p> <ul> <li>Correlate activity log data with other monitoring data collected by Azure Monitor.</li> <li>Consolidate log entries from multiple Azure subscriptions and tenants into one location for analysis together.</li> <li>Use log queries to perform complex analysis and gain deep insights on activity log entries.</li> <li>Use log search alerts with Activity entries for more complex alerting logic.</li> <li>Store activity log entries for longer than the activity log retention period.</li> <li>Incur no data ingestion or retention charges for activity log data stored in a Log Analytics workspace.</li> <li>The default retention period in Log Analytics is 90 days</li> </ul> <p>Select <strong>Export Activity Logs</strong> to send the activity log to a Log Analytics workspace.</p> <p><span class="mx-imgBorder"> <a href="media/activity-log/diagnostic-settings-export.png#lightbox" data-linktype="relative-path"> <img src="media/activity-log/diagnostic-settings-export.png" alt="Screenshot that shows exporting activity logs." data-linktype="relative-path"> </a> </span> </p> <p>You can send the activity log from any single subscription to up to five workspaces.</p> <p>Activity log data in a Log Analytics workspace is stored in a table called <code>AzureActivity</code> that you can retrieve with a <a href="../logs/log-query-overview" data-linktype="relative-path">log query</a> in <a href="../logs/log-analytics-tutorial" data-linktype="relative-path">Log Analytics</a>. The structure of this table varies depending on the <a href="activity-log-schema" data-linktype="relative-path">category of the log entry</a>. For a description of the table properties, see the <a href="/en-us/azure/azure-monitor/reference/tables/azureactivity" data-linktype="absolute-path">Azure Monitor data reference</a>.</p> <p>For example, to view a count of activity log records for each category, use the following query:</p> <pre><code class="lang-kusto">AzureActivity | summarize count() by CategoryValue </code></pre> <p>To retrieve all records in the administrative category, use the following query:</p> <pre><code class="lang-kusto">AzureActivity | where CategoryValue == "Administrative" </code></pre> <div class="IMPORTANT"> <p>Important</p> <p>In some scenarios, it's possible that values in fields of AzureActivity might have different casings from otherwise equivalent values. Take care when querying data in AzureActivity to use case-insensitive operators for string comparisons, or use a scalar function to force a field to a uniform casing before any comparisons. For example, use the <a href="/en-us/azure/kusto/query/tolowerfunction" data-linktype="absolute-path">tolower()</a> function on a field to force it to always be lowercase or the <a href="/en-us/azure/kusto/query/datatypes-string-operators" data-linktype="absolute-path">=~ operator</a> when performing a string comparison.</p> </div> <h2 id="send-to-azure-event-hubs">Send to Azure Event Hubs</h2> <p>Send the activity log to Azure Event Hubs to send entries outside of Azure, for example, to a third-party SIEM or other log analytics solutions. Activity log events from event hubs are consumed in JSON format with a <code>records</code> element that contains the records in each payload. The schema depends on the category and is described in <a href="activity-log-schema" data-linktype="relative-path">Azure activity log event schema</a>.</p> <p>The following sample output data is from event hubs for an activity log:</p> <pre><code class="lang-json">{ "records": [ { "time": "2019-01-21T22:14:26.9792776Z", "resourceId": "/subscriptions/s1/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841", "operationName": "microsoft.support/supporttickets/write", "category": "Write", "resultType": "Success", "resultSignature": "Succeeded.Created", "durationMs": 2826, "callerIpAddress": "111.111.111.11", "correlationId": "aaaa0000-bb11-2222-33cc-444444dddddd", "identity": { "authorization": { "scope": "/subscriptions/s1/resourceGroups/MSSupportGroup/providers/microsoft.support/supporttickets/115012112305841", "action": "microsoft.support/supporttickets/write", "evidence": { "role": "Subscription Admin" } }, "claims": { "aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/", "iat": "1421876371", "nbf": "1421876371", "exp": "1421880271", "ver": "1.0", "http://schemas.microsoft.com/identity/claims/tenantid": "ffffffff-eeee-dddd-cccc-bbbbbbbbbbb0", "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd", "http://schemas.microsoft.com/identity/claims/objectidentifier": "2468adf0-8211-44e3-95xq-85137af64708", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "admin@contoso.com", "puid": "20030000801A118C", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "9vckmEGF7zDKk1YzIY8k0t1_EAPaXoeHyPRn6f413zM", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "John", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Smith", "name": "John Smith", "groups": "cacfe77c-e058-4712-83qw-f9b08849fd60,7f71d11d-4c41-4b23-99d2-d32ce7aa621c,31522864-0578-4ea0-9gdc-e66cc564d18c", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": " admin@contoso.com", "appid": "00001111-aaaa-2222-bbbb-3333cccc4444", "appidacr": "2", "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation", "http://schemas.microsoft.com/claims/authnclassreference": "1" } }, "level": "Information", "location": "global", "properties": { "statusCode": "Created", "serviceRequestId": "50d5cddb-8ca0-47ad-9b80-6cde2207f97c" } } ] } </code></pre> <h2 id="send-to-azure-storage">Send to Azure Storage</h2> <p>Send the activity log to an Azure Storage account if you want to retain your log data longer than 90 days for audit, static analysis, or back up. If you're required to retain your events for 90 days or less, you don't need to set up archival to a storage account. Activity log events are retained in the Azure platform for 90 days.</p> <p>When you send the activity log to Azure, a storage container is created in the storage account as soon as an event occurs. The blobs in the container use the following naming convention:</p> <pre><code>insights-activity-logs/resourceId=/SUBSCRIPTIONS/{subscription ID}/y={four-digit numeric year}/m={two-digit numeric month}/d={two-digit numeric day}/h={two-digit 24-hour clock hour}/m=00/PT1H.json </code></pre> <p>For example, a particular blob might have a name similar to:</p> <pre><code>insights-activity-logs/resourceId=/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/y=2020/m=06/d=08/h=18/m=00/PT1H.json </code></pre> <p>Each PT1H.json blob contains a JSON object with events from log files that were received during the hour specified in the blob URL. During the present hour, events are appended to the PT1H.json file as they're received, regardless of when they were generated. The minute value in the URL, <code>m=00</code> is always <code>00</code> as blobs are created on a per hour basis.</p> <p>Each event is stored in the PT1H.json file with the following format. This format uses a common top-level schema but is otherwise unique for each category, as described in <a href="activity-log-schema" data-linktype="relative-path">Activity log schema</a>.</p> <pre><code class="lang-json">{ "time": "2020-06-12T13:07:46.766Z", "resourceId": "/SUBSCRIPTIONS/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/RESOURCEGROUPS/MY-RESOURCE-GROUP/PROVIDERS/MICROSOFT.COMPUTE/VIRTUALMACHINES/MV-VM-01", "correlationId": "bbbb1111-cc22-3333-44dd-555555eeeeee", "operationName": "Microsoft.Resourcehealth/healthevent/Updated/action", "level": "Information", "resultType": "Updated", "category": "ResourceHealth", "properties": {"eventCategory":"ResourceHealth","eventProperties":{"title":"This virtual machine is starting as requested by an authorized user or process. It will be online shortly.","details":"VirtualMachineStartInitiatedByControlPlane","currentHealthStatus":"Unknown","previousHealthStatus":"Unknown","type":"Downtime","cause":"UserInitiated"}}} </code></pre> <h3 id="other-methods-to-retrieve-activity-log-events">Other methods to retrieve activity log events</h3> <p>You can also access activity log events by using the following methods:</p> <ul> <li>Use the <a href="/en-us/powershell/module/az.monitor/get-azlog" data-linktype="absolute-path">Get-AzLog</a> cmdlet to retrieve the activity log from PowerShell. See <a href="../powershell-samples#retrieve-activity-log" data-linktype="relative-path">Azure Monitor PowerShell samples</a>.</li> <li>Use <a href="/en-us/cli/azure/monitor/activity-log" data-linktype="absolute-path">az monitor activity-log</a> to retrieve the activity log from the CLI. See <a href="../cli-samples#view-activity-log" data-linktype="relative-path">Azure Monitor CLI samples</a>.</li> <li>Use the <a href="/en-us/rest/api/monitor/" data-linktype="absolute-path">Azure Monitor REST API</a> to retrieve the activity log from a REST client.</li> </ul> <h2 id="legacy-collection-methods">Legacy collection methods</h2> <div class="NOTE"> <p>Note</p> <ul> <li>Azure Activity logs solution was used to forward Activity Logs to Azure Log Analytics. This solution is being retired on the 15th of Sept 2026 and will be automatically converted to Diagnostic settings.</li> </ul> </div> <p>If you're collecting activity logs using the legacy collection method, we recommend you <a href="#send-to-log-analytics-workspace" data-linktype="self-bookmark">export activity logs to your Log Analytics workspace</a> and disable the legacy collection using the <a href="/en-us/rest/api/loganalytics/data-sources/delete?tabs=HTTP" data-linktype="absolute-path">Data Sources - Delete API</a> as follows:</p> <ol> <li><p>List all data sources connected to the workspace using the <a href="/en-us/rest/api/loganalytics/data-sources/list-by-workspace?tabs=HTTP#code-try-0" data-linktype="absolute-path">Data Sources - List By Workspace API</a> and filter for activity logs by setting <code>kind eq 'AzureActivityLog'</code>.</p> <p><span class="mx-imgBorder"> <a href="media/activity-log/data-sources-list-by-workspace-api.png#lightbox" data-linktype="relative-path"> <img src="media/activity-log/data-sources-list-by-workspace-api.png" alt="Screenshot showing the configuration of the Data Sources - List By Workspace API." data-linktype="relative-path"> </a> </span> </p> </li> <li><p>Copy the name of the connection you want to disable from the API response.</p> <p><span class="mx-imgBorder"> <a href="media/activity-log/data-sources-list-by-workspace-api-connection.png#lightbox" data-linktype="relative-path"> <img src="media/activity-log/data-sources-list-by-workspace-api-connection.png" alt="Screenshot showing the connection information you need to copy from the output of the Data Sources - List By Workspace API." data-linktype="relative-path"> </a> </span> </p> </li> <li><p>Use the <a href="/en-us/rest/api/loganalytics/data-sources/delete?tabs=HTTP" data-linktype="absolute-path">Data Sources - Delete API</a> to stop collecting activity logs for the specific resource.</p> <p><span class="mx-imgBorder"> <a href="media/activity-log/data-sources-delete-api.png#lightbox" data-linktype="relative-path"> <img src="media/activity-log/data-sources-delete-api.png" alt="Screenshot of the configuration of the Data Sources - Delete API." data-linktype="relative-path"> </a> </span> </p> </li> </ol> <h3 id="managing-legacy-log-profiles---retiring">Managing legacy Log Profiles - retiring</h3> <div class="NOTE"> <p>Note</p> <ul> <li>Logs Profiles was used to forward Activity Logs to storage accounts and Event Hubs. This method is being retired on the 15th of Sept 2026.</li> <li>If you are using this method, transition to Diagnostic Settings before 15th of Sept 2025, when we will stop allowing new creates of Log Profiles.</li> </ul> </div> <p>Log profiles are the legacy method for sending the activity log to storage or event hubs. If you're using this method, transition to Diagnostic Settings, which provide better functionality and consistency with resource logs.</p> <div class="tabGroup" id="tabgroup_1"> <ul role="tablist"> <li role="presentation"> <a href="#tabpanel_1_powershell" role="tab" aria-controls="tabpanel_1_powershell" data-tab="powershell" tabindex="0" aria-selected="true" data-linktype="self-bookmark">PowerShell</a> </li> <li role="presentation"> <a href="#tabpanel_1_cli" role="tab" aria-controls="tabpanel_1_cli" data-tab="cli" tabindex="-1" data-linktype="self-bookmark">CLI</a> </li> </ul> <section id="tabpanel_1_powershell" role="tabpanel" data-tab="powershell"> <p>If a log profile already exists, you first must remove the existing log profile, and then create a new one.</p> <ol> <li><p>Use <code>Get-AzLogProfile</code> to identify if a log profile exists. If a log profile exists, note the <code>Name</code> property.</p> </li> <li><p>Use <code>Remove-AzLogProfile</code> to remove the log profile by using the value from the <code>Name</code> property.</p> <pre><code class="lang-powershell"># For example, if the log profile name is 'default' Remove-AzLogProfile -Name "default" </code></pre> </li> <li><p>Use <code>Add-AzLogProfile</code> to create a new log profile:</p> <pre><code class="lang-powershell">Add-AzLogProfile -Name my_log_profile -StorageAccountId /subscriptions/s1/resourceGroups/myrg1/providers/Microsoft.Storage/storageAccounts/my_storage -serviceBusRuleId /subscriptions/s1/resourceGroups/Default-ServiceBus-EastUS/providers/Microsoft.ServiceBus/namespaces/mytestSB/authorizationrules/RootManageSharedAccessKey -Location global,westus,eastus -RetentionInDays 90 -Category Write,Delete,Action </code></pre> <table> <thead> <tr> <th>Property</th> <th>Required</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>Name</td> <td>Yes</td> <td>Name of your log profile.</td> </tr> <tr> <td>StorageAccountId</td> <td>No</td> <td>Resource ID of the storage account where the activity log should be saved.</td> </tr> <tr> <td>serviceBusRuleId</td> <td>No</td> <td>Service Bus Rule ID for the Service Bus namespace where you want to have event hubs created. This string has the format <code>{service bus resource ID}/authorizationrules/{key name}</code>.</td> </tr> <tr> <td>Location</td> <td>Yes</td> <td>Comma-separated list of regions for which you want to collect activity log events.</td> </tr> <tr> <td>RetentionInDays</td> <td>Yes</td> <td>Number of days for which events should be retained in the storage account, from 1 through 365. A value of zero stores the logs indefinitely.</td> </tr> <tr> <td>Category</td> <td>No</td> <td>Comma-separated list of event categories to be collected. Possible values are Write, Delete, and Action.</td> </tr> </tbody> </table> </li> </ol> <p><strong>Example script</strong></p> <p>This sample PowerShell script creates a log profile that writes the activity log to both a storage account and an event hub.</p> <pre><code class="lang-powershell"># Settings needed for the new log profile $logProfileName = "default" $locations = (Get-AzLocation).Location $locations += "global" $subscriptionId = "<your Azure subscription Id>" $resourceGroupName = "<resource group name your Event Hub belongs to>" $eventHubNamespace = "<Event Hub namespace>" $storageAccountName = "<Storage Account name>" # Build the service bus rule Id from the settings above $serviceBusRuleId = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.EventHub/namespaces/$eventHubNamespace/authorizationrules/RootManageSharedAccessKey" # Build the Storage Account Id from the settings above $storageAccountId = "/subscriptions/$subscriptionId/resourceGroups/$resourceGroupName/providers/Microsoft.Storage/storageAccounts/$storageAccountName" Add-AzLogProfile -Name $logProfileName -Location $locations -StorageAccountId $storageAccountId -ServiceBusRuleId $serviceBusRuleId </code></pre> </section> <section id="tabpanel_1_cli" role="tabpanel" data-tab="cli" aria-hidden="true" hidden="hidden"> <p>If a log profile already exists, you first must remove the existing log profile, and then create a log profile.</p> <ol> <li><p>Use <code>az monitor log-profiles list</code> to identify if a log profile exists.</p> </li> <li><p>Use <code>az monitor log-profiles delete --name "<log profile name></code> to remove the log profile by using the value from the <code>name</code> property.</p> </li> <li><p>Use <code>az monitor log-profiles create</code> to create a log profile:</p> <pre><code class="lang-azurecli" data-interactive="azurecli">az monitor log-profiles create --name "default" --location null --locations "global" "eastus" "westus" --categories "Delete" "Write" "Action" --enabled false --days 0 --service-bus-rule-id "/subscriptions/<YOUR SUBSCRIPTION ID>/resourceGroups/<RESOURCE GROUP NAME>/providers/Microsoft.EventHub/namespaces/<Event Hub NAME SPACE>/authorizationrules/RootManageSharedAccessKey" </code></pre> <table> <thead> <tr> <th>Property</th> <th>Required</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><code>name</code></td> <td>Yes</td> <td>Name of your log profile.</td> </tr> <tr> <td><code>storage-account-id</code></td> <td>Yes</td> <td>Resource ID of the storage account to which activity logs should be saved.</td> </tr> <tr> <td><code>locations</code></td> <td>Yes</td> <td>Space-separated list of regions for which you want to collect activity log events. View a list of all regions for your subscription by using <code>az account list-locations --query [].name</code>.</td> </tr> <tr> <td><code>days</code></td> <td>Yes</td> <td>Number of days for which events should be retained, from 1 through 365. A value of zero stores the logs indefinitely (forever). If zero, then the enabled parameter should be set to False.</td> </tr> <tr> <td><code>enabled</code></td> <td>Yes</td> <td>True or False. Used to enable or disable the retention policy. If True, then the <code>days</code> parameter must be a value greater than zero.</td> </tr> <tr> <td><code>categories</code></td> <td>Yes</td> <td>Space-separated list of event categories that should be collected. Possible values are Write, Delete, and Action.</td> </tr> </tbody> </table> </li> </ol> </section> </div> <h3 id="data-structure-changes">Data structure changes</h3> <p>The Export activity logs experience sends the same data as the legacy method used to send the activity log with some changes to the structure of the <code>AzureActivity</code> table.</p> <p>The columns in the following table are deprecated in the updated schema. They still exist in <code>AzureActivity</code>, but they have no data. The replacements for these columns aren't new, but they contain the same data as the deprecated column. They're in a different format, so you might need to modify log queries that use them.</p> <table> <thead> <tr> <th style="text-align: left;">Activity log JSON</th> <th style="text-align: left;">Log Analytics column name<br><em>(older deprecated)</em></th> <th style="text-align: left;">New Log Analytics column name</th> <th style="text-align: left;">Notes</th> </tr> </thead> <tbody> <tr> <td style="text-align: left;">category</td> <td style="text-align: left;">Category</td> <td style="text-align: left;">CategoryValue</td> <td style="text-align: left;"></td> </tr> <tr> <td style="text-align: left;">status<br><br>Values are success, start, accept, failure</td> <td style="text-align: left;">ActivityStatus <br><br>Values same as JSON</td> <td style="text-align: left;">ActivityStatusValue<br><br>Values change to succeeded, started, accepted, failed</td> <td style="text-align: left;">The valid values change as shown.</td> </tr> <tr> <td style="text-align: left;">subStatus</td> <td style="text-align: left;">ActivitySubstatus</td> <td style="text-align: left;">ActivitySubstatusValue</td> <td style="text-align: left;"></td> </tr> <tr> <td style="text-align: left;">operationName</td> <td style="text-align: left;">OperationName</td> <td style="text-align: left;">OperationNameValue</td> <td style="text-align: left;">REST API localizes the operation name value. Log Analytics UI always shows English.</td> </tr> <tr> <td style="text-align: left;">resourceProviderName</td> <td style="text-align: left;">ResourceProvider</td> <td style="text-align: left;">ResourceProviderValue</td> <td style="text-align: left;"></td> </tr> </tbody> </table> <div class="IMPORTANT"> <p>Important</p> <p>In some cases, the values in these columns might be all uppercase. If you have a query that includes these columns, use the <a href="/en-us/azure/kusto/query/datatypes-string-operators" data-linktype="absolute-path">=~ operator</a> to do a case-insensitive comparison.</p> </div> <p>The following columns have been added to <code>AzureActivity</code> in the updated schema:</p> <ul> <li>Authorization_d</li> <li>Claims_d</li> <li>Properties_d</li> </ul> <h2 id="next-steps">Next steps</h2> <p>Learn more about:</p> <ul> <li><a href="platform-logs-overview" data-linktype="relative-path">Platform logs</a></li> <li><a href="activity-log-schema" data-linktype="relative-path">Activity log event schema</a></li> <li><a href="activity-log-insights" data-linktype="relative-path">Activity log insights</a></li> </ul> </div><div id="ms--inline-notifications" class="margin-block-xs" data-bi-name="inline-notification"></div><div id="assertive-live-region" role="alert" aria-live="assertive" class="visually-hidden" aria-relevant="additions" aria-atomic="true"></div> <div id="polite-live-region" role="status" aria-live="polite" class="visually-hidden" aria-relevant="additions" aria-atomic="true"></div>  </main> <section id="site-user-feedback-footer" class="font-size-sm margin-top-md" data-test-id="site-user-feedback-footer" data-bi-name="site-feedback-section"> <hr class="hr" /> <h2 id="feedback" class="title is-3">Feedback</h2> <div class="display-flex flex-wrap-wrap align-items-center"> <p class="font-weight-semibold margin-xxs margin-left-none">Was this page helpful?</p> <div class="buttons"> <button class="thumb-rating-button like button button-primary button-sm" data-test-id="footer-rating-yes" data-binary-rating-response="rating-yes" type="button" title="This article is helpful" data-bi-name="button-rating-yes" aria-pressed="false" > <span class="icon" aria-hidden="true"> <span class="docon docon-like"></span> </span> <span>Yes</span> </button> <button class="thumb-rating-button dislike button button-primary button-sm" data-test-id="footer-rating-no" data-binary-rating-response="rating-no" type="button" title="This article is not helpful" data-bi-name="button-rating-no" aria-pressed="false" > <span class="icon" aria-hidden="true"> <span class="docon docon-dislike"></span> </span> <span>No</span> </button> </div> </div><div class="display-flex flex-wrap-wrap margin-top-xxs"><div> <a data-bi-name="provide-feedback-cta" class="has-external-link-indicator" href="https://feedback.azure.com/d365community/forum/3887dc70-2025-ec11-b6e6-000d3a4f09d0" data-bi-name="product-feedback" > <span>Provide product feedback</span> </a><span class="margin-inline-xxs" aria-hidden="true">|</span></div><a href="https://learn.microsoft.com/answers/tags/20/azure-monitor/" class="has-external-link-indicator" data-bi-name="get-help-at-qna"> <span>Get help at Microsoft Q&A</span> </a></div> </section> <aside id="ms--additional-resources-mobile" aria-label="Additional resources" class="display-none-desktop display-none-print" > <hr class="hr" hidden /> <h2 id="ms--additional-resources-mobile-heading" class="title is-3" hidden>Additional resources</h2> <section id="right-rail-recommendations-mobile" data-bi-name="recommendations" hidden></section> <section id="right-rail-training-mobile" data-bi-name="learning-resources-card" hidden></section> <section id="right-rail-events-mobile" data-bi-name="events-card" hidden></section> <section id="right-rail-qna-mobile" data-bi-name="qna-link-card" hidden></section> </aside><div class="border-top is-visible-interactive has-default-focus margin-top-sm "><footer id="footer-interactive" data-bi-name="footer" class="footer-layout"><div class="display-flex gap-xs flex-wrap-wrap is-full-height padding-right-lg-desktop"><a data-mscc-ic="false" class="locale-selector-link button button-sm button-clear flex-shrink-0" href="#" data-bi-name="select-locale"> <span class="icon" aria-hidden="true"> <span class="docon docon-world"></span> </span> <span class="local-selector-link-text"></span></a><div class="ccpa-privacy-link" data-ccpa-privacy-link hidden> <a href="https://aka.ms/yourcaliforniaprivacychoices" class="button button-sm button-clear flex-shrink-0" data-mscc-ic="false" data-bi-name="your-privacy-choices" > <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 14" xml:space="preserve" height="16" width="43" aria-hidden="true" focusable="false" > <path d="M7.4 12.8h6.8l3.1-11.6H7.4C4.2 1.2 1.6 3.8 1.6 7s2.6 5.8 5.8 5.8z" style="fill-rule:evenodd;clip-rule:evenodd;fill:#fff"></path> <path d="M22.6 0H7.4c-3.9 0-7 3.1-7 7s3.1 7 7 7h15.2c3.9 0 7-3.1 7-7s-3.2-7-7-7zm-21 7c0-3.2 2.6-5.8 5.8-5.8h9.9l-3.1 11.6H7.4c-3.2 0-5.8-2.6-5.8-5.8z" style="fill-rule:evenodd;clip-rule:evenodd;fill:#06f"></path> <path d="M24.6 4c.2.2.2.6 0 .8L22.5 7l2.2 2.2c.2.2.2.6 0 .8-.2.2-.6.2-.8 0l-2.2-2.2-2.2 2.2c-.2.2-.6.2-.8 0-.2-.2-.2-.6 0-.8L20.8 7l-2.2-2.2c-.2-.2-.2-.6 0-.8.2-.2.6-.2.8 0l2.2 2.2L23.8 4c.2-.2.6-.2.8 0z" style="fill:#fff"></path> <path d="M12.7 4.1c.2.2.3.6.1.8L8.6 9.8c-.1.1-.2.2-.3.2-.2.1-.5.1-.7-.1L5.4 7.7c-.2-.2-.2-.6 0-.8.2-.2.6-.2.8 0L8 8.6l3.8-4.5c.2-.2.6-.2.9 0z" style="fill:#06f"></path> </svg> <span>Your Privacy Choices</span> </a> </div> <div class="flex-shrink-0"> <div class="dropdown has-caret-up"> <button class="dropdown-trigger button button-clear button-sm has-inner-focus theme-dropdown-trigger" aria-controls="theme-menu-interactive" aria-expanded="false" title="Theme" data-bi-name="theme"> <span class="icon"> <span class="docon docon-sun" aria-hidden="true"></span> </span> <span>Theme</span> <span class="icon expanded-indicator" aria-hidden="true"> <span class="docon docon-chevron-down-light"></span> </span> </button> <div class="dropdown-menu" id="theme-menu-interactive" role="menu"> <ul class="theme-selector padding-xxs" role="none"> <li class="theme display-block" role="menuitem"> <button class="button button-clear button-sm theme-control button-block justify-content-flex-start" data-theme-to="light"> <span class="theme-light margin-right-xxs"> <span class="theme-selector-icon border display-inline-block has-body-background" aria-hidden="true"> <svg class="svg" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 22 14"> <rect width="22" height="14" class="has-fill-body-background" /> <rect x="5" y="5" width="12" height="4" class="has-fill-secondary" /> <rect x="5" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="8" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="11" y="2" width="3" height="1" class="has-fill-secondary" /> <rect x="1" y="1" width="2" height="2" class="has-fill-secondary" /> <rect x="5" y="10" width="7" height="2" rx="0.3" class="has-fill-primary" /> <rect x="19" y="1" width="2" height="2" rx="1" class="has-fill-secondary" /> </svg> </span> </span> <span>Light</span> </button> </li> <li class="theme display-block" role="menuitem"> <button class="button button-clear button-sm theme-control button-block justify-content-flex-start" data-theme-to="dark"> <span class="theme-dark margin-right-xxs"> <span class="border theme-selector-icon display-inline-block has-body-background" aria-hidden="true"> <svg class="svg" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 22 14"> <rect width="22" height="14" class="has-fill-body-background" /> <rect x="5" y="5" width="12" height="4" class="has-fill-secondary" /> <rect x="5" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="8" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="11" y="2" width="3" height="1" class="has-fill-secondary" /> <rect x="1" y="1" width="2" height="2" class="has-fill-secondary" /> <rect x="5" y="10" width="7" height="2" rx="0.3" class="has-fill-primary" /> <rect x="19" y="1" width="2" height="2" rx="1" class="has-fill-secondary" /> </svg> </span> </span> <span>Dark</span> </button> </li> <li class="theme display-block" role="menuitem"> <button class="button button-clear button-sm theme-control button-block justify-content-flex-start" data-theme-to="high-contrast"> <span class="theme-high-contrast margin-right-xxs"> <span class="border theme-selector-icon display-inline-block has-body-background" aria-hidden="true"> <svg class="svg" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 22 14"> <rect width="22" height="14" class="has-fill-body-background" /> <rect x="5" y="5" width="12" height="4" class="has-fill-secondary" /> <rect x="5" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="8" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="11" y="2" width="3" height="1" class="has-fill-secondary" /> <rect x="1" y="1" width="2" height="2" class="has-fill-secondary" /> <rect x="5" y="10" width="7" height="2" rx="0.3" class="has-fill-primary" /> <rect x="19" y="1" width="2" height="2" rx="1" class="has-fill-secondary" /> </svg> </span> </span> <span>High contrast</span> </button> </li> </ul> </div> </div> </div> </div> <ul class="links" data-bi-name="footerlinks"> <li class="manage-cookies-holder" hidden></li><li><a class="external-link-indicator" data-mscc-ic="false" href="/en-us/previous-versions/" data-bi-name="archivelink">Previous Versions</a></li> <li><a class="external-link-indicator" data-mscc-ic="false" href="https://techcommunity.microsoft.com/t5/microsoft-learn-blog/bg-p/MicrosoftLearnBlog" data-bi-name="bloglink">Blog</a></li> <li><a class="external-link-indicator" data-mscc-ic="false" href="/en-us/contribute/" data-bi-name="contributorGuide">Contribute</a></li><li><a class="external-link-indicator" data-mscc-ic="false" href="https://go.microsoft.com/fwlink/?LinkId=521839" data-bi-name="privacy">Privacy</a></li><li><a class="external-link-indicator" data-mscc-ic="false" href="/en-us/legal/termsofuse" data-bi-name="termsofuse">Terms of Use</a></li><li><a class="external-link-indicator" data-mscc-ic="false" href="https://www.microsoft.com/legal/intellectualproperty/Trademarks/" data-bi-name="trademarks">Trademarks</a></li><li>© Microsoft 2025</li> </ul> </footer></div></div><div id="ms--additional-resources" class="right-container column is-4-desktop display-none display-block-desktop" data-bi-name="pageactions" role="complementary" aria-label="Additional resources" > <div id="affixed-right-container" class="margin-top-sm-tablet" data-bi-name="right-column"> <h2 id="ms--additional-resources-heading" class="title is-6 margin-top-md" hidden>Additional resources</h2> <section id="right-rail-events" data-bi-name="events-card" hidden></section> <section id="right-rail-training" data-bi-name="learning-resources-card" hidden></section> <section id="right-rail-recommendations" data-bi-name="recommendations" hidden></section> <nav id="side-doc-outline" class="doc-outline" data-bi-name="intopic toc" aria-label="In this article"> <h3>In this article</h3> </nav> <section id="right-rail-qna" class="margin-top-xxs" data-bi-name="qna-link-card" hidden></section> </div> </div></div>  </section>   <aside id="interactive-container" class="interactive-container is-visible-interactive column has-body-background-dark "> </aside>  </div> </div>  <section class="border-top has-default-focus is-hidden-interactive margin-top-sm "><footer id="footer" data-bi-name="footer" class="footer-layout uhf-container has-padding" role="contentinfo"><div class="display-flex gap-xs flex-wrap-wrap is-full-height padding-right-lg-desktop"><a data-mscc-ic="false" class="locale-selector-link button button-sm button-clear flex-shrink-0" href="#" data-bi-name="select-locale"> <span class="icon" aria-hidden="true"> <span class="docon docon-world"></span> </span> <span class="local-selector-link-text"></span></a><div class="ccpa-privacy-link" data-ccpa-privacy-link hidden> <a href="https://aka.ms/yourcaliforniaprivacychoices" class="button button-sm button-clear flex-shrink-0" data-mscc-ic="false" data-bi-name="your-privacy-choices" > <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 14" xml:space="preserve" height="16" width="43" aria-hidden="true" focusable="false" > <path d="M7.4 12.8h6.8l3.1-11.6H7.4C4.2 1.2 1.6 3.8 1.6 7s2.6 5.8 5.8 5.8z" style="fill-rule:evenodd;clip-rule:evenodd;fill:#fff"></path> <path d="M22.6 0H7.4c-3.9 0-7 3.1-7 7s3.1 7 7 7h15.2c3.9 0 7-3.1 7-7s-3.2-7-7-7zm-21 7c0-3.2 2.6-5.8 5.8-5.8h9.9l-3.1 11.6H7.4c-3.2 0-5.8-2.6-5.8-5.8z" style="fill-rule:evenodd;clip-rule:evenodd;fill:#06f"></path> <path d="M24.6 4c.2.2.2.6 0 .8L22.5 7l2.2 2.2c.2.2.2.6 0 .8-.2.2-.6.2-.8 0l-2.2-2.2-2.2 2.2c-.2.2-.6.2-.8 0-.2-.2-.2-.6 0-.8L20.8 7l-2.2-2.2c-.2-.2-.2-.6 0-.8.2-.2.6-.2.8 0l2.2 2.2L23.8 4c.2-.2.6-.2.8 0z" style="fill:#fff"></path> <path d="M12.7 4.1c.2.2.3.6.1.8L8.6 9.8c-.1.1-.2.2-.3.2-.2.1-.5.1-.7-.1L5.4 7.7c-.2-.2-.2-.6 0-.8.2-.2.6-.2.8 0L8 8.6l3.8-4.5c.2-.2.6-.2.9 0z" style="fill:#06f"></path> </svg> <span>Your Privacy Choices</span> </a> </div> <div class="flex-shrink-0"> <div class="dropdown has-caret-up"> <button class="dropdown-trigger button button-clear button-sm has-inner-focus theme-dropdown-trigger" aria-controls="theme-menu" aria-expanded="false" title="Theme" data-bi-name="theme"> <span class="icon"> <span class="docon docon-sun" aria-hidden="true"></span> </span> <span>Theme</span> <span class="icon expanded-indicator" aria-hidden="true"> <span class="docon docon-chevron-down-light"></span> </span> </button> <div class="dropdown-menu" id="theme-menu" role="menu"> <ul class="theme-selector padding-xxs" role="none"> <li class="theme display-block" role="menuitem"> <button class="button button-clear button-sm theme-control button-block justify-content-flex-start" data-theme-to="light"> <span class="theme-light margin-right-xxs"> <span class="theme-selector-icon border display-inline-block has-body-background" aria-hidden="true"> <svg class="svg" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 22 14"> <rect width="22" height="14" class="has-fill-body-background" /> <rect x="5" y="5" width="12" height="4" class="has-fill-secondary" /> <rect x="5" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="8" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="11" y="2" width="3" height="1" class="has-fill-secondary" /> <rect x="1" y="1" width="2" height="2" class="has-fill-secondary" /> <rect x="5" y="10" width="7" height="2" rx="0.3" class="has-fill-primary" /> <rect x="19" y="1" width="2" height="2" rx="1" class="has-fill-secondary" /> </svg> </span> </span> <span>Light</span> </button> </li> <li class="theme display-block" role="menuitem"> <button class="button button-clear button-sm theme-control button-block justify-content-flex-start" data-theme-to="dark"> <span class="theme-dark margin-right-xxs"> <span class="border theme-selector-icon display-inline-block has-body-background" aria-hidden="true"> <svg class="svg" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 22 14"> <rect width="22" height="14" class="has-fill-body-background" /> <rect x="5" y="5" width="12" height="4" class="has-fill-secondary" /> <rect x="5" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="8" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="11" y="2" width="3" height="1" class="has-fill-secondary" /> <rect x="1" y="1" width="2" height="2" class="has-fill-secondary" /> <rect x="5" y="10" width="7" height="2" rx="0.3" class="has-fill-primary" /> <rect x="19" y="1" width="2" height="2" rx="1" class="has-fill-secondary" /> </svg> </span> </span> <span>Dark</span> </button> </li> <li class="theme display-block" role="menuitem"> <button class="button button-clear button-sm theme-control button-block justify-content-flex-start" data-theme-to="high-contrast"> <span class="theme-high-contrast margin-right-xxs"> <span class="border theme-selector-icon display-inline-block has-body-background" aria-hidden="true"> <svg class="svg" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 22 14"> <rect width="22" height="14" class="has-fill-body-background" /> <rect x="5" y="5" width="12" height="4" class="has-fill-secondary" /> <rect x="5" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="8" y="2" width="2" height="1" class="has-fill-secondary" /> <rect x="11" y="2" width="3" height="1" class="has-fill-secondary" /> <rect x="1" y="1" width="2" height="2" class="has-fill-secondary" /> <rect x="5" y="10" width="7" height="2" rx="0.3" class="has-fill-primary" /> <rect x="19" y="1" width="2" height="2" rx="1" class="has-fill-secondary" /> </svg> </span> </span> <span>High contrast</span> </button> </li> </ul> </div> </div> </div> </div> <ul class="links" data-bi-name="footerlinks"> <li class="manage-cookies-holder" hidden></li><li><a class="external-link-indicator" data-mscc-ic="false" href="/en-us/previous-versions/" data-bi-name="archivelink">Previous Versions</a></li> <li><a class="external-link-indicator" data-mscc-ic="false" href="https://techcommunity.microsoft.com/t5/microsoft-learn-blog/bg-p/MicrosoftLearnBlog" data-bi-name="bloglink">Blog</a></li> <li><a class="external-link-indicator" data-mscc-ic="false" href="/en-us/contribute/" data-bi-name="contributorGuide">Contribute</a></li><li><a class="external-link-indicator" data-mscc-ic="false" href="https://go.microsoft.com/fwlink/?LinkId=521839" data-bi-name="privacy">Privacy</a></li><li><a class="external-link-indicator" data-mscc-ic="false" href="/en-us/legal/termsofuse" data-bi-name="termsofuse">Terms of Use</a></li><li><a class="external-link-indicator" data-mscc-ic="false" href="https://www.microsoft.com/legal/intellectualproperty/Trademarks/" data-bi-name="trademarks">Trademarks</a></li><li>© Microsoft 2025</li> </ul> </footer> </section> <div id="action-panel" role="region" aria-label="Action Panel" class="action-panel has-default-focus" tabindex="-1"></div> </body> </html>