Azure Powershell cmd-let - Get-AzureRmLog doesn't show “Microsoft.Authorization/” logs

Question

I have prepared Azure PowerShell script for catching RBAC changes information from Azure Activity Logs. When I am testing this script on my test subscription, script works fine. Problem is when I used connect-azurermaccount -subscription command and switched to the prod subscription. In the Azure activity log blade I saw that there were some logs related to RBAC changes, log names like "Create role assignment". I was testing with commands like below:

Get-AzureRmLog -StartTime (Get-Date).AddDays(-10) | 
Where-Object {$_.Authorization.Action -like 
"Microsoft.Authorization/roleAssignments/*"}

and

Get-AzureRmLog -StartTime 2019-09-01T10:30 | Where-Object {$_.Authorization.Action -like "*Microsoft.Authorization/*"}

I didnt see any output in the console. When I logged to the Azure portal and opened Activity log I was able to see logs related to RBAC changes, log names --> "Delete role assignment", "Create role assignment". I was testing mentioned commands with string "Microsoft.Compute":

Get-AzureRmLog -StartTime (Get-Date).AddDays(-10) | 
Where-Object {$_.Authorization.Action -like 
""*Microsoft.Compute/*""}

and

Get-AzureRmLog -StartTime 2019-09-01T10:30 | Where-Object {$_.Authorization.Action -like "*Microsoft.Compute/*"}`

I could see the logs information in the output. I am not sure what is wrong and what should I correct. Why can't I use this filter in my prod subscription --> "Microsoft.Authorization/", I would like to highlight that on my test subscription script worked perfectly fine.

Jim Xu Jim Xu · Accepted Answer · 2019-09-16T05:08:21

If you want to get the logs related to RBAC changes, you can use the following the script to get it.

Connect-AzureRmAccount

Get-AzureRmLog -ResourceProvider Microsoft.Authorization -StartTime (Get-Date).AddMonths(-1)

For more details, please refer to https://docs.microsoft.com/en-us/powershell/module/azurerm.insights/get-azurermlog?view=azurermps-6.13.0

Update

If you want to use Azure rest api to get the logs related to RBAC changes, you need to use the rest api as below:

Method : GET
URL:https://management.azure.com/subscriptions/<subscription id>/providers/microsoft.insights/eventtypes/management/values
Params:
       api-version = 2017-03-01-preview
       $filter = eventTimestamp ge 'your strat time' and resourceTypes eq 'microsoft.authorization/roleassignments'
Header:
       Authorization : Bearer access_token

For example:

According to my test, if the numbers of your log are too big, the results will be paged. If you want to get the other pages' results, we need to send request to the nextlink which is a parameter in the result.

Azure Powershell cmd-let - Get-AzureRmLog doesn't show “Microsoft.Authorization/” logs

1 Answers