Monitor log profile should have activity logs for global services and all regions


Configure the log profile to export activities from all Azure supported regions/locations including global. This rule is evaluated against all resource locations that Fugue has permission to scan.

Portal Remediation Steps

  • Note this rule applies to the legacy experience for Azure Activity log.

  • Navigate to Activity log.

  • Select Diagnostics setting.

  • Click Looking for the legacy experience? Click here to launch the ‘Export activity log’ blade.

  • From the Regions drop-down, check Select all.

  • Click Save.

CLI Remediation Steps

  • Retrieve a list of all locations enabled for your subscription:

az account list-locations --query [].name
  • To enable activity logs for global services and all regions, follow the Azure documentation to create a log profile and set the desired flags, including a space-separated list of locations (e.g., --locations "global" "eastus" "westus" etc.) according to the list you retrieved:

az monitor log-profiles create --categories
                               --enabled {false, true}