Azure Compliance ControlsAzure Monitor
Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs
Azure Monitor Diagnostic Settings are configured to export the Activity Log to an external destination (Log Analytics, Storage, Event Hub, or partner). The check applies at the subscription level. Administrative, Security, Policy, and Alert categories are collected.
What this control checks
Subscription has a diagnostic setting exporting the Activity Log to an external destination.
Framework mappings
The clauses this control is mapped to in each framework.
- 10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
18 more clauses
- 10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
- 10.3.1: Audit logs are protected from destruction and unauthorized modifications.
- 10.3.2: Audit logs are protected from destruction and unauthorized modifications.
- 10.3.3: Audit log files, including those for externalfacing technologies, are promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify
- 10.3.4: File integrity monitoring or change-detection mechanisms is used on audit logs to ensure that existing log data cannot be changed without generating alerts
- 10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
- 10.5.1: Retain audit log history for at least 12 months, with at least the most recent three months immediately available for analysis
- 10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
- 10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
- 11.5.2: A change-detection mechanism (for example, file integrity monitoring tools) is deployed
- 12.10.5: The security incident response plan includes monitoring and responding to alerts from security monitoring systems
- A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
- A3.5.1: Suspicious events are identified and responded to.
- 2 Risk management policy
- 3 Incident handling
- 7.1.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
- 7.1.1.2 Ensure Diagnostic Setting captures appropriate categories
- 6.1.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
- 6.1.1.2 Ensure Diagnostic Setting captures appropriate categories
- 6.1.1.8 Ensure that a Microsoft Entra diagnostic setting exists to send Microsoft Graph activity logs to an appropriate destination
- 6.1.1.9 Ensure that a Microsoft Entra diagnostic setting exists to send Microsoft Entra activity logs to an appropriate destination
- 6.1.4 Ensure that Azure Monitor Resource Logging is Enabled for All Services that Support it
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- HR-04.01B The cloud service provider classifies information of security-sensitive positions according to their level of risk, including positions related to IT administration and all positions with access to cloud service customer data or system components for the provisioning of the cloud...
- IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse.
- OPS-05.03AC The configuration of the protection mechanisms is monitored automatically.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-12.01B The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data are implemented by technically supported procedures with regard to the following restrictions: - Access only for authorised users and...
1 more clause
- OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
- 5.1.1 Ensure that a 'Diagnostic Setting' exists
- 5.1.2 Ensure Diagnostic Setting captures appropriate categories
- 5.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
- 5.1.2 Ensure Diagnostic Setting captures appropriate categories
- 6.1.1 Ensure that a 'Diagnostic Setting' exists for Subscription Activity Logs
- 6.1.2 Ensure Diagnostic Setting captures appropriate categories
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.308(a)(5)(ii)(C) Log-in monitoring
- 164.308(a)(6)(ii): Administrative Safeguards
- 164.312(b) Audit controls
Related controls
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
- Azure subscriptions should have an Activity Log Alert configured for Delete Public IP Address rule
- Azure subscriptions should have an Activity Log Alert configured for Create, Update, or Delete SQL Server Firewall Rule
- Network security group flow logs should have retention set to greater than 90 days
- App Service web apps should have HTTP logs enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
monitor_diagnostic_settings_exists_for_subscription - Powerpipe Control:
azure_compliance.control.monitor_diagnostic_settings_exists_for_subscription - Prowler Checks:
monitor_diagnostic_setting_with_appropriate_categories,monitor_diagnostic_settings_exists
Last reviewed: 2026-10-13