Activity Explorer
Browse Azure Activity Log operations across your management groups, subscriptions, resource groups, and individual resources. Filter by time range, user, and operation type to isolate the events that matter for change auditing, incident triage, and RBAC review.
What You'll Learn
- Drill from organization scope down to a single resource using the column hierarchy
- Filter operations by user, type, and time window
- Read per-event cards with the actor, status, and parsed change details
- Inspect role assignments and subscription moves with friendly summaries
- Share or bookmark a view by copying the URL
Key Capabilities
Column Hierarchy
Browse top-down through Management Groups and Subscriptions, into Resource Groups, into individual Resources. Each column shows operation-count badges so you can see where activity is concentrated before drilling in.
Live Filtering
Set a time range, pick a user, or limit to certain operation types. The badges and details panel recompute immediately, so you can verify a filter is doing what you expect.
Parsed Operation Details
Role assignments and subscription moves are rendered as friendly summaries with their own property tables. Every card can also reveal the raw Activity Log JSON for deep inspection.
Scope-Level Operations
A magnifying-glass icon next to a subscription or resource group means there are operations targeting that scope itself, separate from operations on its children. Click the icon to see those scope-level events without expanding.
Shareable URL State
Your selection, time range, and filters are reflected in the URL. Bookmark a view or paste the link to a teammate and the page reopens in the same state.
Related Features
Feature Integration
Activity Explorer works alongside other StratoLens features:
- Resource Changes lives under the same sidebar group (Azure Logs > Change Logs) and is the place to inspect resource configuration diffs over time.
- Automated Scanning populates the Activity Log data shown here. The page can only display what scans have collected.
- Activity modals embedded on other pages (for example, an entity's key-properties header) include a View All Activity in Activity Explorer button that opens this page with the entity, operations, and time range pre-selected.
Documentation Sections
Start here to learn how to use the page.
Want to learn more about what Activity Explorer can do?
Check out the feature page for benefits, use cases, and highlights.
View Feature Page