Change Logs
Find out what changed in your Azure environment between any two points in time, who made each change, and exactly which properties were modified. Open Azure Logs > Change Logs from the left sidebar. The page header reads Resource Changes, both names refer to the same screen.
On This Page
Prerequisites
Requires the Change Tracking read permission. At least one StratoLens scan must have completed, the page is empty until the first scan finishes capturing change data.
Time Range and Filters
The page header has four controls: Start, End, User, and Type. Every change in every column reflects the current values, change any control and badge counts and lists update instantly.
Defaults
- Time range
- Yesterday 12:00 AM through today 11:59 PM, in your browser's local time.
- User
- All users.
- Type
- All three types shown (Create, Update, Delete).
A time range is always required
There is no "all time" option, both Start and End are required. If a shared URL produces an invalid range, the page shows an error.
The User dropdown is scoped to the time range
The list only includes users who actually made a change inside the current time range, not the full Entra ID directory. Widen the range to see more users.
On narrow windows the filters collapse behind a Filters button with a small badge showing how many filters are active. Click it to open a popover with the same User and Type controls.
Browsing the Hierarchy
The page lays out the four entity levels left-to-right as you drill in: Subscriptions (with management groups stacked at the top), Resource Groups, then Resources. Each entry has color-coded badges showing Create (green), Update (orange), and Delete (red) counts within the current filters.
Only entities with changes are listed
Subscriptions and management groups with no changes in the current time range and filters do not appear at all. If a subscription you expected is missing, widen the time range or relax the User and Type filters.
Drilling Down
- Click a Subscription row. The Resource Groups column opens to its right.
- Click a Resource Group row. The Resources column opens.
- Click a Resource. The detail panel opens on the far right with every change for that resource in the current time range.
Container-level changes use the lens icon
A small magnifying-lens icon appears next to a subscription or resource group only when that container itself has changes (for example, the subscription was renamed or the resource group was tagged). Click the lens to open the container's own detail panel. Click the row instead to drill into its children.
Reclaiming Horizontal Space
Once you've drilled deep, click the small left-chevron in any column header to ultra-collapse that column to a thin vertical strip showing only the selected entity's name. Click the right-chevron in the strip to expand it again.
The Detail Panel
Selecting an entity opens the detail panel on the right. It lists every change matching the current filters, one card per change, sorted most-recent first. Each card shows the resource name, a colored change-type badge, the timestamp, and the user who made the change.
Page behavior
- Page size
- 25 changes per page. Pagination only appears when total changes exceed one page.
- Sort order
- Most recent change first.
- View in Explorer
- The button at the top-right opens the same entity in Resource Explorer.
Inspecting a Change
Click any change card to expand it. The card reveals a Property Changes table with three columns: Property, Old Value, New Value. Added rows are tinted green, deleted rows are tinted red, and nested objects (such as tags or properties) are expandable rows with a chevron.
Wrap long values
Toggle Wrap all above the table to wrap long string values across multiple lines instead of truncating them. Useful for connection strings, JSON blobs, and certificates.
Create and Delete events have one side only
Create events show (New resource) and only the New Value column is populated. Delete events show (Deleted resource) and only the Old Value column is populated.
Show Raw JSON
Click Show Raw JSON at the bottom of an expanded card to see the complete change record as StratoLens stored it. Click Hide Raw JSON to collapse it again. The raw record is the fallback for any change where Azure Resource Graph did not provide a full before/after snapshot.
Sharing an Investigation
Every selection you make, time range, filters, expanded columns, and the selected entity, is encoded in the URL. Copy the URL to bookmark a view or share it with a teammate. Reloading restores the same investigation, and other StratoLens pages may deep-link into Change Logs with an entity already selected.
Troubleshooting
Clicking a subscription expanded its children but didn't show its own changes
Use the lens icon
Clicking the row expands the column to show resource groups, it doesn't open the detail panel. To see changes made to the subscription itself (for example a rename), click the small magnifying-lens icon next to the subscription name. The lens only appears when the subscription has its own changes.
The Property Changes table says "Resource state details are not available for this change record"
What this means
StratoLens captured the change event but Azure Resource Graph did not provide a before/after snapshot for it, this can happen for some container-level events. The change is still real, click Show Raw JSON to see the complete record.
The page shows "Something went wrong with Resource Changes"
What to try
This is the page's error boundary, usually triggered by malformed URL parameters from a copied or edited link. Click Reset Selection to clear all filters and selections, or Retry to reload as-is.
The detail panel says "No changes found for X in selected time range"
Filters excluded everything
Your filters (user, change type, or time range) excluded every change for that entity. The empty-state message names which filter is responsible. Try widening the time range or selecting All users.