Public preview: Change Actor

With Change Analysis you can now see who initiated the change and with which client that change was made, for changes across all your tenants and subscriptions.  

Audit, troubleshoot, and govern at scale   

By using Azure Resource Graph to query your resource changes, you can craft charts and pin results to Azure dashboards based on specific change queries.   

 What’s new: Actor Functionality  

• Who made the change   
• With which client the change was made  
• What operation was called 

Try it out 

You can try it out by querying the “resourcechanges” or “resourcecontainerchanges” tables in Azure Resource Graph.

Sample Query

The following query shows the Summarization of who and which client were used to make resource changes in the last 7 days ordered by the number of changes 

resourcechanges  

| extend changeTime = todatetime(properties.changeAttributes.timestamp),  

targetResourceId = tostring(properties.targetResourceId),  

changeType = tostring(properties.changeType), changedBy = tostring(properties.changeAttributes.changedBy),  

changedByType = properties.changeAttributes.changedByType,  

clientType = tostring(properties.changeAttributes.clientType)  

| where changeTime > ago(7d)  

| project changeType, changedBy, changedByType, clientType  

| summarize count() by changedBy, changeType, clientType  

| order by count_ desc 

If you're just getting started with changes and want to learn how to query resourcechanges and resourcecontainerchanges in Azure Resource Graph, you can learn about the service here.

Get resource configuration changes - Azure Resource Graph | Microsoft Learn