Audit, configuration & compliance
AWS CloudTrail vs Azure Monitor activity log (and Entra audit logs)
AWS CloudTrail maps to the Azure Monitor activity log for resource operations, plus Microsoft Entra audit and sign-in logs for identity events.
Resource-level data-plane logs come from each service's diagnostic settings.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS CloudTrail | Azure Monitor activity log (and Entra audit logs) |
| Lifecycle | Generally available | Generally available |
| What it is | Records API activity. Event history gives 90 days of management events for free, trails deliver events to S3 and CloudWatch Logs, and CloudTrail Lake stores and queries events with SQL. | Subscription-level control-plane events (create, update, delete, and actions) kept for 90 days, exportable through diagnostic settings to Log Analytics, storage, or Event Hubs. Entra audit and sign-in logs cover identity events. |
| Pricing model | The first copy of management events in trails is free. Data events, extra copies, and CloudTrail Lake are billed. | Activity log entries are free for 90 days. You pay for Log Analytics ingestion or storage when exporting. |
| Docs | AWS CloudTrail docs | Azure Monitor activity log (and Entra audit logs) docs |
| Pricing page | AWS CloudTrail pricing | Azure Monitor activity log (and Entra audit logs) pricing |
| Exams | SAA-C03 SOA-C03 SCS-C03 | AZ-104 SC-500 |
Key differences
- Retention. CloudTrail event history keeps 90 days of management events free, and trails or CloudTrail Lake keep events longer. The activity log keeps 90 days free, and diagnostic settings export it to Log Analytics, storage, or Event Hubs for longer retention.
- Data events. CloudTrail data events (for example, S3 object reads) are opt-in on trails. On Azure, data-plane activity comes from resource logs (such as Storage or Key Vault diagnostic logs).
- Organization-wide. CloudTrail organization trails cover all accounts. On Azure, apply diagnostic settings at scale with Azure Policy.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- The first copy of management events in trails is free. Data events, extra copies, and CloudTrail Lake are billed. AWS CloudTrail pricing →
- Azure
- Activity log entries are free for 90 days. You pay for Log Analytics ingestion or storage when exporting. Azure Monitor activity log (and Entra audit logs) pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Solutions Architect – Associate SAA-C03 | AWS | Associate | current Italian version retires after Dec 31, 2026. |
| AWS Certified CloudOps Engineer – Associate SOA-C03 | AWS | Associate | current Replaces AWS Certified SysOps Administrator – Associate (SOA-C02), whose last exam day was Sep 29, 2025. Simplified Chinese and Korean versions retire after Nov 19, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS CloudTrail?
AWS CloudTrail maps to the Azure Monitor activity log for resource operations, plus Microsoft Entra audit and sign-in logs for identity events. Resource-level data-plane logs come from each service's diagnostic settings.
How does pricing compare between AWS CloudTrail and Azure Monitor activity log (and Entra audit logs)?
AWS: The first copy of management events in trails is free. Data events, extra copies, and CloudTrail Lake are billed. Azure: Activity log entries are free for 90 days. You pay for Log Analytics ingestion or storage when exporting. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Solutions Architect – Associate (SAA-C03); AWS Certified CloudOps Engineer – Associate (SOA-C03); AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).