Overview
Resource auditing is a document type in Azure Documenter that generates an audit log report for your Azure subscriptions, covering resources created, updated, and deleted during a selected timespan, along with the cost incurred.
Business value
Resource auditing documents give operations and finance teams a single, exportable record of what changed across their subscriptions and what those changes cost, without manually correlating Azure activity logs and billing data.
Prerequisites
Required permissions
The following Turbo360 role permissions control access to the Documentation section, where generated documents are accessed and managed:
| Role | Permission level | Access |
|---|---|---|
| Account owner, Owner, Contributor | - | Full access to the Documentation section |
| Custom role | Read | View documents generated under Documentation |
| Custom role | Manage | View, generate, and manage documents under Documentation |
How it works
The Resource auditing document contains:
- An overall audit summary of resources added, removed, or modified across the subscription(s), with the cost incurred.
- A breakdown of the subscription's resource count and cost incurred, grouped by resource types added, resource types modified, resource types deleted, resource groups added, and resource groups modified.
- A section listing subscriptions that have no audit logs for the selected timespan.
Steps
Use the following steps to generate a Resource auditing document. Navigate to Azure Documenter to get started.
- Click New configuration. The Configure your document wizard opens.
- In Step 1 (Basics), enter a configuration name. Under Choose document type, select Resource auditing. Configure the following options:
- Billing range: the audit period for the report (maximum span: 90 days)
- Currency: the currency in which cost data is displayed
- Resource states: filters the report to show resources matching selected states: All, Added, Modified, or Deleted
- In Step 2 (Service principal), select the service principal and configure the subscription scope. Click Next.
- Complete Steps 3–6 (Branding, Publish settings, Schedule, Notifications) as required. Click Next after each step.
- In Step 7 (Review), confirm your configuration and click Finish.
Once generation is complete, a URL is created for the document, and you can download it using the Download link.
Example scenario
An operations team investigating an unexpected cost spike generates a Resource auditing document for the affected subscription over the last 30 days, using it to identify which resources were added or modified and the cost each change contributed.
Limitations
- The billing range for a Resource auditing document supports a maximum span of 90 days.
Troubleshooting
-
Resource auditing document returns no activity for the selected period
Cause: no resource changes occurred in the selected subscriptions during the billing range, or the billing range is set to a period with no activity.
Fix: expand the billing range or confirm resource activity exists for the selected subscriptions. -
Document generation fails or returns incomplete data
Cause: the service principal lacks the required permissions to access activity logs or billing data for the selected subscriptions.
Fix: verify the service principal has at least Reader access on all selected subscriptions, then regenerate. -
Resource states filter returns fewer results than expected
Cause: the selected state filter (Added, Modified, or Deleted) is more restrictive than intended.
Fix: set Resource states to All in Step 1 (Basics) to include resources across all change states.
FAQs
-
What is the maximum billing range for a Resource auditing document?
The billing range supports a maximum span of 90 days, whether using a preset option or a custom range. -
What information does the report show for a modified resource?
The report groups modified resources by resource type and resource group, alongside the cost incurred, as part of the overall audit summary. -
What happens if a subscription has no audit logs for the selected timespan?
It is listed separately in a dedicated section of the generated document rather than mixed in with subscriptions that had activity.