How to monitor read write activities on Azure Blob Storage

Question

Need to figure out how to log/retrieve information about who (which Azure AD user) has read/write on blobs in our azure blob storage.

I know you can turn on logging on the storage account level using this:

I can see in the logs the different api calls that have been performed on the blob but If I myself went via the azure portal to open some of the blobs, I could not see this activity recorded in the logs. Any ideas how to monitor this? I need it for auditing purposes.

Answer 1

When you enable Storage Analytics on Portal, you will have $logs folder on your Blob with storage logs.

When you are using Azure AD authentication you need to configure 2.0 logs and use UserPrincipalName column to identify the user and parse the column with JSON AuthorizationDetail.action to identify the action of the user on storage, i.e. Microsoft.Storage/storageAccounts/blobServices/containers/read for list the blobs in a container.

You will not capture OAuth/Azure AD authenticated requests with log format 1.0.

On Azure Storage Uservoice there is also the request for integration with LogAnalytics to simplify logs monitoring, the private preview should start this month.