---
canonical_url: "https://docs.composio.dev/toolkits/azure_monitor_activity_log"
markdown_url: "https://docs.composio.dev/toolkits/azure_monitor_activity_log.md"
product: "platform"
version: null
last_updated: null
---

# Azure Monitor Activity Log

Query Azure Monitor Activity Log events and retrieve category metadata for one subscription using delegated Microsoft OAuth.

- **Category:** it operations
- **Auth:** OAUTH2
- **Composio-managed OAuth available?** No
- **Tools:** 2
- **Triggers:** 0
- **Slug:** `AZURE_MONITOR_ACTIVITY_LOG`
- **Version:** 00000000_00

## Tools

### List Event Categories

**Slug:** `AZURE_MONITOR_ACTIVITY_LOG_LIST_EVENT_CATEGORIES`

Return the Activity Log event categories recognized by Azure, including their localized labels when available.

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Activity Log Events

**Slug:** `AZURE_MONITOR_ACTIVITY_LOG_LIST_EVENTS`

Return one page of Activity Log events for a UTC time range from the subscription selected when the Azure connection was created. Legacy connections missing that selection work only when exactly one subscription is visible; otherwise reconnect. Optionally narrow by one documented resource or correlation field.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `fields` | array | No | Optional event fields to return. Omit to return all available fields; an empty list is invalid. |
| `end_time` | string | No | Optional inclusive UTC end time as YYYY-MM-DDTHH:MM:SS[.fffffff]Z. When supplied, start_time is required and end_time must not be earlier than it. Up to seven fractional digits are preserved exactly. |
| `narrowing` | object | No | Optional single documented resource or correlation filter. Raw OData expressions are not accepted. |
| `start_time` | string | No | Inclusive UTC start time as YYYY-MM-DDTHH:MM:SS[.fffffff]Z. Required unless next_cursor is supplied, and must be within Azure's 90-day retention window. Up to seven fractional digits are preserved exactly. |
| `next_cursor` | string | No | Opaque cursor returned by a previous call. Pass it unchanged to fetch the next page; the original time range, narrowing, and field selection are retained. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |