Azure Compliance ControlsAzure Logic Apps
Logic App workflows should have resource logs enabled
Checks whether each Azure Logic App workflow has `diagnostic settings` configured to send resource logs. The control inspects the diagnostic settings attached to every workflow resource and evaluates whether resource log collection is set up for it.
What this control checks
Logic App workflows (Microsoft.Logic/workflows) must have a diagnostic setting with logs enabled.
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
FedRAMP Moderate Baseline Rev 4
- AU-12 Audit Generation
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- 1203.09aa1System.2-09.aa 09.10 Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
logic_app_workflow_logging_enabled - Powerpipe Control:
azure_compliance.control.logic_app_workflow_logging_enabled - Azure Policy Definition:
34f95f76-5386-4de7-b824-0d8478470c9d
Last reviewed: 2026-10-13