0

I am trying to access the Directory activity log in my Azure tenant, but I am getting the error that I don't have permission to view Directory log.

I am trying to figure out if anyone know the permission required to view those logs.

Also, I am trying to have the least privilege possible.

enter image description here

Sridevi
  • 10,599
  • 1
  • 4
  • 17
Nader Sipahy
  • 1
  • 2

1 Answers1

0

Note that, Azure RBAC roles under subscription won't work for accessing Directory Activity logs.

To access the Directory activity log, you need to have Global Administrator role on your Azure tenant.

When I tried to access Directory activity log with user having Contributor role, I got same error as you like below:

enter image description here

To resolve the error, I assigned Global Administrator role to the user under Azure AD tenant like below:

Go to Azure Portal -> Azure Active Directory -> Roles and Administrators -> All roles -> Global Administrator

enter image description here

After assigning above role, you can also check Assigned roles of the user like below:

enter image description here

You need to wait for 5-10 minutes after assigning the directory role as there will be delay.

When I tried to access Directory Activity logs with above user after few minutes, I can see the logs successfully like below:

enter image description here

Reference: Azure Active Directory activity logs in Azure Monitor - Microsoft

Sridevi
  • 10,599
  • 1
  • 4
  • 17
  • I tried the custom role but I am still not able to access the logs. Do I need more then the microsoft.directory/auditLogs/allProperties/read role? – Nader Sipahy Jun 05 '23 at 12:41
  • I think you need to add more other than that. Did it work if you assign **Global Administrator** role? – Sridevi Jun 05 '23 at 12:43
  • Yes with Global Administrator it is working, but I need to follow the least privileges. – Nader Sipahy Jun 05 '23 at 12:48
  • I tried creating custom directory roles but it's not working. I believe only users with **Global Administrator** can view Directory Activity logs. – Sridevi Jun 06 '23 at 13:37