An auditor investigating a data-loss incident at Cascade Regional Airlines asks which storage account blobs were deleted and by whom last Tuesday. The engineer checks the subscription's activity log and finds no matching entries, even though the storage account itself was never modified. What is the correct explanation?
Select an answer to reveal the explanation.
Short Explanation
The activity log is like a building's front-desk sign-in sheet: it tracks who came in and changed the office layout, not what someone did once they sat down at a desk inside. Deleting a blob happens inside the account's data plane, which the front desk never sees.
Full Explanation
The activity log records control-plane operations performed through Azure Resource Manager, such as creating, updating, or deleting the storage account resource itself, role assignments, or configuration changes, but it has no visibility into data-plane operations that happen inside the resource, like reading, writing, or deleting an individual blob. To answer who deleted a specific blob, the correct source is storage logging enabled through diagnostic settings sending blob-service logs to a Log Analytics workspace or storage account, which does capture data-plane requests including delete operations with caller identity when configured. The activity log's retention is actually 90 days by default, not 24 hours, so that is not the limiting factor here. There is no alternate resource-provider name under which blob deletions would appear in the activity log; the gap is categorical, not a naming or filtering issue. A data collection rule applies to Azure Monitor Agent telemetry from compute resources and performance counters, not to storage data-plane logging, which is configured separately. The actionable fix going forward is to enable diagnostic settings on the storage account for blob read/write/delete categories before the next audit request arrives.