how do i find in azure firewall who has deleted a specific firewall rule

Hi Arulkumar Kasilingam I want to help you with this question.

When I understand you right, you want to know which Identity in Azure did an edit/delete action on azure firewall rules.

You can find this out in the Azure activity logs. It logs every change event in the Azure resource manager.

Azure Activity Logs are retained for 90 days by default. You can access these logs in several places:

1. Azure Portal: Navigate to the “Activity Log” section under “Monitor” to view and filter logs.
2. Azure CLI: Use commands like az monitor activity-log list to retrieve logs.
3. PowerShell: Use cmdlets such as Get-AzActivityLog.
4. Azure Monitor REST API: Programmatically access logs using the API.

If you need to retain logs for longer than 90 days, you can export them to an Azure Storage account, Log Analytics workspace, or Event Hub for extended retention and analysis.

Here you can find more details about the feature:

https://video2.skills-academy.com/en-us/azure/azure-monitor/data-sources

https://video2.skills-academy.com/en-us/azure/azure-monitor/essentials/activity-log-schema#administrative-category

https://video2.skills-academy.com/en-us/azure/azure-monitor/essentials/activity-log-schema#administrative-category

If the reply was helpful, please don’t forget to upvote or accept it as an answer, thank you!