Azure Logic App Disabled Or Deleted
Query
AzureActivity
| where OperationNameValue == "MICROSOFT.LOGIC/WORKFLOWS/DISABLE/ACTION" or OperationName == "MICROSOFT.LOGIC/WORKFLOWS/DELETE"
| where ActivityStatusValue startswith "Succe" or ActivityStatusValue startswith "accept" // Comment out if you want to look for attempts
//Azure Activity must be enabled https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log?tabs=log-analytics?WT.mc_id=MVP_473477Explanation
This query is searching through Azure Activity logs to find specific operations related to Azure Logic Apps. It filters the logs to show only those activities where:
-
The operation is either disabling a workflow action or deleting a workflow, as indicated by the operation names "MICROSOFT.LOGIC/WORKFLOWS/DISABLE/ACTION" or "MICROSOFT.LOGIC/WORKFLOWS/DELETE".
-
The activity status starts with "Succe" (likely indicating "Success") or "accept" (possibly indicating "Accepted"). This means it is looking for activities that were successfully completed or accepted.
Additionally, there is a comment suggesting that if you want to look for attempts (not just successful or accepted ones), you can modify the query by commenting out the line that filters by activity status. The query also includes a note that Azure Activity logging must be enabled to capture these logs, with a link to the relevant documentation for more information.
Details
Jay Kerai
Released: October 3, 2025
Tables
Keywords
Operators