Activity logs on management groups

Directory activity log

• https://www.invictus-ir.com/news/the-azure-log-you-probably-didnt-know-existed

Diagnostics setting creation

$mg = Get-AzManagementGroup -GroupName "test"

$wsId = “” # fill this

$conf = New-AzDiagnosticSettingLogSettingsObject -Category "Administrative" -Enabled $true
New-AzDiagnosticSetting -Name foo -ResourceId $mg.Id -WorkspaceId $wsId -Log $conf

This creates diagnostics setting on management group level but activity logs are ingestes only from contained subscriptions.

If you need to store management group-level activity logs you need to do your own logic. Examples:

• https://journeyofthegeek.com/2019/10/21/capturing-azure-management-group-activity-logs-using-azure-automation-part-2/