Service Bus namespaces should have resource logs enabled
Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised. Applies to Microsoft.ServiceBus/namespaces.
Resource logs enable you to recreate activity trails to use for investigation purposes. This matters when a security incident occurs or when your network is compromised.
What this control checks
Service Bus namespaces must have diagnostic settings with resource logs enabled.
Common pitfalls
requiredRetentionDays defaults to 365
The requiredRetentionDays parameter defaults to 365. The policy describes it as "The required resource logs retention in days".
Effect is AuditIfNotExists by default
The effect parameter has a defaultValue of AuditIfNotExists. The allowedValues are AuditIfNotExists and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Resource logs in Service Bus should be enabled" (f8d36e2f-389b-4ee4-898d-21aeb69a0f45); PowerPipe control azure_compliance.control.servicebus_namespace_logging_enabled.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AU-12 (Audit Record Generation), AU-12(1) (System-wide and Time-correlated Audit Trail), AU-6(4) (Central Review and Analysis) and 1 more clause.
FedRAMP Moderate Baseline Rev 4: Mapped to AU-12 (Audit Generation).
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
FedRAMP Moderate Baseline Rev 4
- AU-12 Audit Generation
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- 1208.09aa3System.1-09.aa 09.10 Monitoring
Related controls
- Kubernetes clusters should have logging enabled
- Flow log resources should have flow logging enabled
- Storage account Table services should have Storage Logging enabled for 'Read', 'Write', and 'Delete' requests
- Azure Monitor should have activity log collection enabled for all regions
- Azure subscriptions should have a log profile for Activity Log
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
servicebus_namespace_logging_enabled - Powerpipe Control:
azure_compliance.control.servicebus_namespace_logging_enabled - Azure Policy Definition:
f8d36e2f-389b-4ee4-898d-21aeb69a0f45
Last reviewed: 2026-10-15