Developer Tools & Devops · Azure Monitor Activity Log + Claude
Azure Monitor Activity Log MCP with Claude: Audit Changes and Trace Failed Operations Faster
The short answer
Claude connects to Azure Monitor Activity Log through the Model Context Protocol (MCP) or a direct API. Once signed in with OAuth, Claude can query activity events, retrieve category details, filter by resource and time, and summarise failed operations in plain language, within permissions your organisation sets.
What is Azure Monitor Activity Log?
Azure Monitor Activity Log is a service in Microsoft Azure that records management and control-plane events for an Azure subscription. Every create, change or delete action on your Azure resources can leave a trail here. Cloud engineers, platform teams, security staff and IT auditors use it to see who changed what, when, and whether an operation succeeded or failed.
How Claude connects to Azure Monitor Activity Log through MCP
The Model Context Protocol (MCP) is an open standard that lets Claude securely use other software. Think of it as a universal adapter between Claude and a tool. Claude asks for information or takes an action, and the adapter carries that request to the tool and brings back the answer.
Once connected through OAuth sign-in, Claude can query activity events, retrieve category metadata, filter logs by resource and time window, and summarise failed operations. A team member can ask, in everyday language, which changes were made to a storage account last Tuesday, and Claude returns a clear summary with the relevant entries.
Permissions stay with your organisation. Access is granted with least-privilege settings, so Claude only sees what the connected account is allowed to see. Consequential actions can be routed for human approval, and every request is traceable, so people remain in charge of decisions.
What you can automate
Change auditing for compliance reviews
Auditors often need proof of who altered a resource and when. Claude can pull activity events for a chosen subscription and time range, group them by resource, and produce a readable list of changes. Reviewers receive a summary they can check against the source records, which saves hours of manual filtering before each audit cycle.
Troubleshooting a failed deployment
When a release breaks, engineers need to know which operation failed and why. Claude can filter activity events to the affected resource group and summarise the failed operations, highlighting status messages and timestamps. This helps the on-call team focus on the likely cause rather than scrolling through long raw logs during an incident.
Morning health briefings for platform leads
Platform leads can ask Claude each morning for a summary of overnight control-plane activity across their subscriptions. Claude can list notable create, update and delete events and flag any failed operations. The result is a short briefing that replaces a routine manual check and keeps the team aware of unexpected changes.
Investigating unexpected resource changes
When a cost spike or configuration drift appears, finance and operations staff want to know what changed. Claude can search activity events by resource and time window, identify the operations involved, and present the sequence in plain English. Technical staff can then verify the findings before any corrective action is taken.
Answering service desk questions
Service desk agents often receive questions such as whether a change was made to a shared service. Claude can retrieve the relevant activity records and explain them in simple terms, so agents can reply accurately without needing deep Azure knowledge. Escalations to engineers become faster and better informed.
An end-to-end workflow: Overnight change review with ticket logging
TriggerEvery weekday at 08:00, a scheduled request asks Claude to review the previous day's activity for the production subscription.
Claude queries Azure Monitor Activity Log for control-plane events from the previous 24 hours, filtered to production resource groups.
Claude identifies failed operations and groups unexpected create, update and delete events by resource owner.
Claude compares flagged changes against approved change requests held in the organisation's ticketing system.
Claude drafts a summary listing unmatched changes and failed operations, with timestamps and resource names.
The platform lead reviews the summary and approves or escalates each item in the ticketing system.
Claude records the review outcome as a ticket note for the audit trail.
OutcomeUnapproved changes are spotted within the first hour of each working day, and audit evidence is stored automatically. Results will vary by environment, but teams typically report a shorter review cycle and fewer surprises during audits.
How we set it up
Free automation audit
We review your Azure subscriptions, reporting routines and incident processes to identify the workflows where Activity Log data would save the most time.
Secure connection with OAuth sign-in
We connect Claude to Azure Monitor Activity Log using OAuth sign-in, through the official MCP server or a direct API, with least-privilege access scoped to the subscriptions you approve.
Workflow design
We design the end-to-end workflow across Activity Log and your other systems, such as Microsoft 365, ticketing or ERP, and set clear approval points for consequential actions.
Testing against real cases
We test queries and summaries against past incidents and audit requests from your own environment to confirm the results are accurate and useful.
Launch, monitoring and team training
We launch with audit logging and monitoring in place, then train your engineers, auditors and service desk staff on how to use the workflow confidently.
Who benefits
- Cloud and platform engineers
- Faster root-cause analysis when deployments or configurations fail.
- Compliance and internal audit teams
- Quicker access to traceable records of who changed what and when.
- IT operations and service desk leads
- Plain-English answers to change questions without waiting on engineers.
- CIOs and finance controllers
- Better visibility of unexpected resource changes that affect cost and risk.
Security and control
- Least-privilege OAuth access, limited to the subscriptions and resource groups you approve.
- Human approval required before Claude takes any consequential action.
- Audit logs of every query Claude makes, so usage can be reviewed later.
- Regular review of connected permissions as your Azure estate changes.
- Testing on your own historical data before any workflow goes live.
For teams in the US, UK, India and the Middle East
Organisations in the United States and the United Kingdom can host the Claude workflow in their preferred region to align with local data protection expectations. Indian organisations operate under the Digital Personal Data Protection Act, 2023, and we design data handling to support those obligations. Organisations in the UAE and Saudi Arabia must meet their national data protection laws, so hosting location and access controls are chosen with those requirements in mind. Hosting region is selected to meet your requirements, and we confirm the design with your legal and security teams.
Learn more about Claude and MCP
Anthropic's AI model and assistant.
Secure links between Claude and business tools.
How engineers build and change software with Claude.
Hosted agents that run multi-step work.
The open standard Claude uses to connect to tools.
Frequently asked questions
What does the Azure Monitor Activity Log MCP server do?
The MCP server gives Claude a secure route into Activity Log. Through it, Claude can query activity events, retrieve category information, filter by resource and time, and summarise failed operations. It works as a structured bridge, so Claude asks for specific records rather than accessing your subscription freely.
Is connecting Claude to Activity Log secure?
Security depends on the design, and we build it carefully. Access uses OAuth sign-in with least-privilege permissions, limited to the scopes you approve. Consequential actions can require human approval, and usage can be logged for review. We also test access controls before launch.
What can Claude actually do with Activity Log?
Claude can read and interpret activity events. Typical tasks include listing changes to a resource, finding failed operations, retrieving category metadata, and writing plain-English summaries. Claude does not change Azure resources through this connection unless your design explicitly allows it, with approvals in place.
How long does setup take?
Timing depends on the number of subscriptions, the workflows chosen and your approval requirements. A focused single-workflow setup is often completed within a few weeks, including testing and training. We confirm the timeline during the free automation audit.
Which Azure plan or permissions are needed?
Connection requires an Azure account with sufficient read access to the subscriptions you want Claude to query, granted through OAuth sign-in. The exact role assignments depend on your Azure setup, so we confirm the minimum permissions needed during the audit rather than assuming broad access.