0

Some one has deleted the file share folder from the storage account in azure . It can be recovered as soft delete is enabled. But how to know that who has deleted the file?

Suri007
  • 71
  • 1
  • 7
  • You can find the name who deleted the fileshare from the Azure storage account by going into the Azure portal--> storage account-->`Activity log`. – RKM Sep 21 '22 at 12:33
  • Hi Rajkumar, Thanks for the answer. I had already checked this but didn't help to find out the user who has deleted. – Suri007 Sep 21 '22 at 14:59

1 Answers1

1

It is possible to view operations within an Azure resource using Resource Logs. This is possible by Monitoring Azure Blob Storage which is a feature of Azure Monitor.

You would first start with creating a Diagnostic Setting- https://learn.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal#creating-a-diagnostic-setting

And then view logged activity by using a Log Analytics query or you can go the destination that you are forwarding the logs to as setup in the diagnostics setting and look for the respective API, example- "DeleteBlob" or "DeleteContainer" etc.,

However, if you have not already setup a diagnostic setting already and are forwarding data to a specific destination, it may not be possible to retrieve this information right now. Hope this helps!

SKishor-MSFT
  • 91
  • 1