Stream Analytics jobs should have resource logs enabled
Audit enabling of resource logs. This enables you to recreate activity trails to use for investigation purposes; when a security incident occurs or when your network is compromised. Applies to Azure Stream Analytics jobs.
What this control checks
Azure Policy check f9be5368-9bf5-4b84-9e0a-7850da98bb46 looks at resources of type Microsoft.StreamAnalytics/streamingJobs and uses the effect AuditIfNotExists by default. It requires a Microsoft.Insights/diagnosticSettings with at least one log where logs.enabled equals true. The requiredRetentionDays parameter defaults to 365. Powerpipe check stream_analytics_job_logging_enabled returns alarm when diagnostic_settings is null or no enabled log matches, and ok otherwise.
Framework mappings
The clauses this control is mapped to in each framework.
- AU-6(4) Central Review And Analysis
- AU-6(5) Central Review And Analysis
- AU-12 Audit Record Generation
- AU-12(1) System-Wide And Time-Correlated Audit Trial
FedRAMP Moderate Baseline Rev 4
- AU-12 Audit Generation
- 3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- 3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU.L2-3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity
- AU.L2-3.3.2 Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions
- AU-6(4) Central Review And Analysis
- AU-6(5) Integration / Scanning And Monitoring Capabilities
- AU-12 Audit Generation
- AU-12(1) System-Wide / Time-Correlated Audit Trail
- 1207.09aa2System.4-09.aa 09.10 Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
stream_analytics_job_logging_enabled - Powerpipe Control:
azure_compliance.control.stream_analytics_job_logging_enabled - Azure Policy Definition:
f9be5368-9bf5-4b84-9e0a-7850da98bb46
Last reviewed: 2026-10-15