Azure Monitor should have activity log collection enabled for all regions
This policy audits the Azure Monitor log profile which does not export activities from all Azure supported regions including global. Log profiles should capture all regions to ensure that all events are logged.
Log profiles should capture all regions to ensure that all events are logged.
What this control checks
Log profile must export activities from all Azure supported regions including global.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Monitor should collect activity logs from all regions" (41388f1c-2db0-4c25-95b2-35d7f5ccbfa9); PowerPipe control azure_compliance.control.monitor_log_profile_enabled_for_all_regions.
Scans of the Terraform code that flag the same setting before deployment: Trivy check AZU-0032.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-03 (Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties...), ID.AM-07 (Inventories of data and corresponding metadata for designated data types are maintained.), PR.IR-02 (The organization's technology assets are protected from environmental threats.) and 6 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- ID.AM-07: Inventories of data and corresponding metadata for designated data types are maintained.
- PR.IR-02
- PR.IR-04
- PR.PS-01
4 more clauses
- PR.PS-02
- PR.PS-03
- PR.PS-04
- PR.PS-06
- 3.1.g Trails
- 1120.09ab3System.9-09.ab 09.10 Monitoring
- 1214.09ab2System.3456-09.ab 09.10 Monitoring
Related controls
- Azure Monitor log profiles should have log collection enabled for 'write', 'delete', and 'action' categories
- Storage accounts containing activity log containers should use customer-managed keys for encryption
- Azure subscriptions should have an Activity Log Alert configured for Create, Update, or Delete SQL Server Firewall Rule
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
monitor_log_profile_enabled_for_all_regions - Powerpipe Control:
azure_compliance.control.monitor_log_profile_enabled_for_all_regions - Azure Policy Definition:
41388f1c-2db0-4c25-95b2-35d7f5ccbfa9 - Trivy Check:
AZU-0032
Last reviewed: 2026-10-13