Azure Compliance ControlsAzure IoT Hub
IoT hubs should have resource logs enabled
Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised. The check applies to IoT Hub.
What this control checks
Fails and raises an alarm if the check conditions are not met
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
FedRAMP Moderate Baseline Rev 4
- AU-12 Audit Generation
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- 1204.09aa1System.3-09.aa 09.10 Monitoring
Related controls
- Batch accounts should have resource logs enabled
- Storage account Queue services should have Storage logging enabled for read, write, and delete requests
- Network security groups should have flow logs configured
- PostgreSQL servers should have 'log_retention_days' set to greater than 3 days
- SQL servers auditing to storage accounts should have retention set to 90 days or more
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
iot_hub_logging_enabled - Powerpipe Control:
azure_compliance.control.iot_hub_logging_enabled - Azure Policy Definition:
383856f8-de7f-44a2-81fc-e5135b5c2aa4
Last reviewed: 2026-10-13