Prove Azure is working — first tool + proof field

1. Why “is it working?” is five questions

Operators collapse five failures into one sentence. Someone wrote the NSG at 09:18 UTC and nobody named the caller. The packet never allowed at the NIC. Defender has marked the storage account Unhealthy for a week. Conditional Access blocked the grant and helpdesk still says “MFA is on.” The Key Vault AuditEvent category never left the resource because no diagnostic setting exists. Those are five first clicks.

The factory taught the hops: tenant, then effective NSG, then UDR next hop, then Conditional Access grant. This page is the night-shift desk for proof. You are already in the subscription — or you think you are — and someone is asking whether the control even works. You open the tool that is allowed to answer that question, then you quote one official field.

Hero · five tiles, one ticket

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you ship a bad change at 02:00. The factory named the hop. This desk names the store.

3. Decision flow — ticket → first tool

Flowchart first. Do not open the NSG inbound editor or the Conditional Access policy until a diamond says so. Tenant and subscription still come from the factory: confirm them before the first lookup.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to the Azure portal. If you cannot recite the proof field, you are not ready to change anything. Official paths only — learn.microsoft.com wording.

5. Runbook Side A → B → C

Side A proves the ARM write and the packet. Side B proves the recommendation status and the Conditional Access grant. Side C proves the diagnostic pipe. On a messy Sev-2, do them in this order until a field lights up. Isolate (read-only) until the field is on the ticket. Change-control is a later drawer — that split is in the factory.

Side A — Activity Log + NSG / VNet flow (write, then packet)

1. Confirm tenant and subscription, then open Activity log

   Path: Azure portal → Monitor → Activity log. Opening it from Monitor filters on the subscription. Opening it from a resource filters on that resource. Official: Activity Log in Azure Monitor. Specify the time interval. Default retention is 90 days — both ends of the window must fall inside it.

2. Filter Operation + Event initiated by, then open JSON

   Add Filter: Operation (create / delete / write), Event initiated by (the identity), Event category = Administrative when you are hunting a write. Open the event → JSON. Quote operationName.value (example: Microsoft.Network/networkSecurityGroups/write), status.value (Started / In Progress / Succeeded / Failed), and caller. Source: Azure Activity Log event schema — Administrative category.

3. If the ticket is a packet, switch stores — do not stay in Activity Log

   Path: search Network Watcher → Flow logs. Prefer a virtual network flow log. Official: NSG flow logs retire on 30 September 2027; Microsoft recommends migrating to virtual network flow logs. Logs land in a storage account as PT1H.json (NSG container insights-logs-networksecuritygroupflowevent; VNet container insights-logs-flowlogflowevent). Traffic Analytics (if enabled) is the searchable view.

4. Read traffic decision + 5-tuple + rule, not the NSG screenshot

   NSG flowTuples are comma-separated: timestamp, source IP, destination IP, source port, destination port, protocol (T/U), traffic flow (I/O), traffic decision (A allowed / D denied), plus version-2 flow state. The parent object names rule (example: DefaultRule_DenyAllInBound). VNet flow logs use Flow state D for deny and still name rule. Quote the decision letter, the five fields, and the rule. Source: NSG Flow Logs Overview; Virtual Network Flow Logs.

Side B — Defender recommendation + Entra sign-in (posture, then grant)

1. Open Recommendations, not Secure Score as the close

   Path: Azure portal → search Microsoft Defender for Cloud → Recommendations. Official: Review security recommendations. Filter Environment = Azure, then open the recommendation title (or Inventory → the resource → Recommendations tab). Secure Score is a backlog pointer. The ticket is one resource against one recommendation.

2. Quote Unhealthy + recommendation name + resource

   Defender for Cloud uses Healthy and Unhealthy for whether a resource is compliant with a specific security recommendation; Not applicable means the check does not apply. Resource health lists the recommendations for which that resource is Unhealthy. Quote the recommendation title, the resource ID, and Unhealthy. Source: Investigate the health of your resources; Review security recommendations.

3. If the ticket is a blocked sign-in, switch to Entra — do not stay in Defender

   Path: sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Reports Reader → Entra ID → Monitoring & health → Sign-in logs. Official: Troubleshooting sign-in problems with Conditional Access. Filter Username + Date + Resource; add Conditional Access = Failure to shrink the list. Open the event that matches the user’s time.

4. Read the Conditional Access tab, then the error code

   CA status values: Not Applied (no policy in scope), Success (in-scope policies satisfied), Failure (in-scope grant not satisfied or set to block). Open Conditional Access and quote the policy name that resulted in the interruption. Common codes: 53003 BlockedByConditionalAccess, 53000 DeviceNotCompliant, 53001 DeviceNotDomainJoined. “Enabled” on the user object is not a grant. Source: Sign-in logs; Microsoft Entra monitoring and health FAQ.

Side C — Diagnostic settings (the pipe the other tools need)

1. Open Diagnostic settings on the resource, not a random workbook

   Path: on the resource menu, Monitoring → Diagnostic settings. Or Azure Monitor → Settings → Diagnostic settings → select the resource. Official: Diagnostic settings in Azure Monitor. Activity Log itself is collected without a setting; resource logs are not. If the list is empty, that is the ticket.

2. Quote destination + categories (or their absence)

   A setting names: destination (Log Analytics workspace, Storage account, Event Hubs, or a partner solution), plus which log categories or category groups (audit / allLogs) and whether AllMetrics is on. One setting can have at most one of each destination type; a resource can have up to five settings. Quote the setting name, the workspace (or storage) resource ID, and the enabled categories. A missing setting is not “Azure logging is down.”

3. If Activity Log must live longer than 90 days, export it here too

   Path: Monitor → Activity log → Export Activity Logs (a subscription-scope diagnostic setting). Categories include Administrative, Security, ServiceHealth, Alert, Recommendation, Policy, Autoscale. Use this when the auditor asks for 365-day control-plane history — not when the ticket is a Get Secret.

Path:            Resource → Monitoring → Diagnostic settings
Quote:           setting name + destination resource ID + enabled categories
Empty list:      resource logs are not collected — that is the close
Activity Log:    90 days, control plane, no setting required
Export:          Monitor → Activity log → Export Activity Logs (subscription scope)
Limit:           ≤5 settings per resource; ≤1 of each destination type per setting

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times, identities, and IPs below are lab-only (subscription lab-prod, tenant Techclick-Lab, RFC 5737 203.0.113.88).

Journey · one D is the ticket

AZ-EVD-01 — Prove the write (Activity Log)

01:42 · P2. HTTPS from partners died after 09:18 UTC. L1 already drafted an inbound Allow-any. Nobody named who edited app-nsg.

First tool: Monitor → Activity log, this subscription. Filter Operation = Microsoft.Network/networkSecurityGroups/write, timespan covering 09:00–10:00 UTC. Open the Succeeded event → JSON.

Proof field: operationName = Microsoft.Network/networkSecurityGroups/write, status = Succeeded, caller = priya@lab.example, eventTimestamp = 09:18:11Z, resourceId ending in /networkSecurityGroups/app-nsg. That triple is the ticket. The factory then names the effective rule. This desk only proves who wrote it and that ARM accepted the write.

AZ-EVD-02 — Prove the packet (NSG / VNet flow)

02:05 · P2. Partner on 203.0.113.88 cannot reach the NIC on 443. Internal 10/8 works. Network wants 0.0.0.0/0 on 443 “for five minutes.”

First tool: Network Watcher → Flow logs on vnet-app (VNet). Download the hour blob or open Traffic Analytics. Confirm the MAC / NIC is the app NIC, not a jump box.

Proof field: 10.0.8.22 → 10.1.0.4:443 T I A on UserRule_Allow-HTTPS-10; 203.0.113.88 → 10.1.0.4:443 T I D on DefaultRule_DenyAllInBound. That pair is the ticket. Next hop (factory): effective security rules, then UDR next hop if the packet never arrived. Change-control, if approved: partner /32 + description, never 0.0.0.0/0.

AZ-EVD-03 — Prove the recommendation (Defender for Cloud)

02:20 · P3. Auditor on the bridge: “You said storage encryption is on. Prove the control is working.” L1 pasted Secure Score 62. No resource, no recommendation title.

First tool: Defender for Cloud → Recommendations. Open the encryption recommendation. Filter to stlabappuploads. Or Inventory → that storage account → Recommendations tab.

Proof field: recommendation title + resource stlabappuploads + status Unhealthy. Healthy on a sibling account is a useful contrast, not a close for this resource. Not applicable means the check does not apply — do not tell the auditor “green.” Secure Score moving is not an evaluation of this bucket.

AZ-EVD-04 — Prove the grant (Entra sign-in log)

02:40 · P2. Priya cannot open the Azure portal. Helpdesk: “her account is Enabled.” L1 wants the MFA Conditional Access policy deleted.

First tool: Entra admin center → Entra ID → Monitoring & health → Sign-in logs. Filter Username = priya@lab.example, Date = last hour, Conditional Access = Failure. Open the event → Conditional Access tab.

Proof field: overall CA status Failure, error 53003 BlockedByConditionalAccess, policy CA-Require-MFA-Admins result Failure, grant = Require multifactor authentication. Enabled is the account state. The sign-in log is the decision. If the row is empty, you are in the wrong tenant — go back to the factory.

AZ-EVD-05 — Prove the pipe (Diagnostic settings)

03:00 · P2. Security wants Key Vault AuditEvent for a suspected Get Secret. Logs blade is empty. Chat typed Sev-1 and “rebuild the vault.” Activity Log is quiet except for a write last week.

First tool: Key Vault lab-app-kv → Monitoring → Diagnostic settings.

Proof field: settings list is empty. Resource logs are not collected until a diagnostic setting exists. That sentence is the ticket. Next: add a setting — destination law-lab-sec, category AuditEvent (or category group audit) — under change-control. Then wait for ingestion. Do not rebuild the vault. Do not grant the on-call Owner so they can “see something.”

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• Microsoft Learn — Activity Log in Azure Monitor (Monitor → Activity log; 90 days; control plane; filters Operation / Event initiated by / Event category)
• Microsoft Learn — Azure Activity Log event schema (operationName, status, caller, Administrative category)
• Microsoft Learn — Overview of Azure platform logs (Activity log vs resource logs vs metrics)
• Microsoft Learn — NSG flow logs overview (flowTuples; traffic decision A/D; rule; retire 30 Sep 2027)
• Microsoft Learn — Virtual network flow logs (Flow state D = deny; rule; preferred over NSG flow logs)
• Microsoft Learn — Migrate to virtual network flow logs
• Microsoft Learn — Manage virtual network flow logs (Network Watcher → Flow logs; storage path)
• Microsoft Learn — Traffic analytics overview
• Microsoft Learn — Review security recommendations (Defender for Cloud → Recommendations)
• Microsoft Learn — Investigate the health of your resources (Healthy / Unhealthy; Inventory → resource)
• Microsoft Learn — Secure score in Defender for Cloud (score is a pointer, not a resource evaluation)
• Microsoft Learn — Sign-in logs in Microsoft Entra ID (Entra ID → Monitoring & health → Sign-in logs; Reports Reader)
• Microsoft Learn — Troubleshooting sign-in problems with Conditional Access (Conditional Access tab; error 53003 / 53000)
• Microsoft Learn — Sign-in log activity details (Conditional Access Success / Failure)
• Microsoft Learn — Microsoft Entra monitoring and health FAQ (CA status Not Applied / Success / Failure)
• Microsoft Learn — Diagnostic settings in Azure Monitor (resource → Monitoring → Diagnostic settings; destinations; resource logs not collected by default)
• Microsoft Learn — Integrate Microsoft Entra logs with Azure Monitor (Entra ID → Monitoring & health → Diagnostic settings)

Related: Blog 1 · Azure Security factory · NSG and Azure Firewall · Entra Conditional Access · Defender for Cloud · Key Vault secrets · Azure Security practice dashboard