How to query Azure SQL Server Audit Logs using SQL

azure sql server

We log all of our Azure SQL Server queries to a storage account using the Audit Logs feature. They are mainly used for security checks, but sometimes I use them to debug an app. Today I discovered you don’t need to go to the Azure Portal to view them or download them using Storage Explorer.

You can query them directly from your SQL client:

SELECT TOP 100 event_time, server_instance_name, database_name, server_principal_name, client_ip, statement, succeeded, action_id, class_type, additional_information
FROM sys.fn_get_audit_file('https://[storage_account].blob.core.windows.net/sqldbauditlogs/[sql-server-name]/[db-name]/SqlDbAuditing_ServerAudit/2021-12-14/', default, default)
--WHERE (event_time <= '2021-12-13T21:32:30.327Z')
/* additional WHERE clause conditions/filters can be added here */
ORDER BY statement DESC