There’s a new public preview feature named Change History in Azure Monitor Activity Logs that allows you to get a better feel for what caused events in the first place.
I don’t know about you, but wading through a JSON description of an event to determine what happened can be a little cumbersome at times, and this feature is a great time-saver.
To get to the feature, go to Monitor and then click Activity Log:
This is the list of all your management plane activities across your subscription consumed by Azure Monitor.
NOTE: If you don’t see Monitor in the list on the left, type monitor in the Search resources, services, and docs textbox at the top of the portal:
Below is an expanded example of the Activity log from my personal subscription:
Now click on an Update event – in this example, I will click the first event. As you can see I have been experimenting with Azure Private DNS; I had just got done running this example.
Notice there’s a new option named Change history (preview):
There’s a list of changes to this resource shown and if I click any of these entries, the following pops up:
As you can see – right there is the diff – this change was me changing a tag named vmRelated from True to False.
More info is available here.
Simple, but effective!
Michael's Security Blog 