Azure Cosmos DB Azure-Microsoft.DocumentDB
any: Azure Cosmos DB (catch-all)
#Description
Catch-all for Azure-Microsoft.DocumentDB rules that match the resource provider but no specific operation.
Microsoft.DocumentDB/cassandraClusters/dataCenters/delete
#Description
Delete a data center in a managed Cassandra cluster
Microsoft.DocumentDB/cassandraClusters/dataCenters/write
#Description
Create or update a data center in a managed Cassandra cluster
Microsoft.DocumentDB/cassandraClusters/delete
#Description
Delete a managed Cassandra cluster
Microsoft.DocumentDB/cassandraClusters/fetchNodeStatus/action
#Description
Asynchronously fetch node status of all nodes in a managed Cassandra cluster
Microsoft.DocumentDB/cassandraClusters/repair/action
#Description
Request a repair of a managed Cassandra keyspace
Microsoft.DocumentDB/cassandraClusters/write
#Description
Create or update a managed Cassandra cluster
Microsoft.DocumentDB/databaseAccounts/apis/databases/collections/delete
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Delete a collection. Only applicable to API types: 'mongodb'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/collections/settings/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Update a collection throughput. Only applicable to API types: 'mongodb'. Only applicable for setting types: 'throughput'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/collections/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Create or update a collection. Only applicable to API types: 'mongodb'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/containers/delete
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Delete a container. Only applicable to API types: 'sql'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/containers/settings/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Update a container throughput. Only applicable to API types: 'sql'. Only applicable for setting types: 'throughput'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/containers/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Create or update a container. Only applicable to API types: 'sql'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/delete
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Delete a database. Only applicable to API types: 'sql', 'mongodb', 'gremlin'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/graphs/delete
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Delete a graph. Only applicable to API types: 'gremlin'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/graphs/settings/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Update a graph throughput. Only applicable to API types: 'gremlin'. Only applicable for setting types: 'throughput'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/graphs/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Create or update a graph. Only applicable to API types: 'gremlin'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/settings/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Update a database throughput. Only applicable to API types: 'sql', 'mongodb', 'gremlin'. Only applicable for setting types: 'throughput'.
Microsoft.DocumentDB/databaseAccounts/apis/databases/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Create a database. Only applicable to API types: 'sql', 'mongodb', 'gremlin'.
Microsoft.DocumentDB/databaseAccounts/apis/keyspaces/delete
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Delete a keyspace. Only applicable to API types: 'cassandra'.
Microsoft.DocumentDB/databaseAccounts/apis/keyspaces/settings/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Update a keyspace throughput. Only applicable to API types: 'cassandra'. Only applicable for setting types: 'throughput'.
Microsoft.DocumentDB/databaseAccounts/apis/keyspaces/tables/delete
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Delete a table. Only applicable to API types: 'cassandra'.
Microsoft.DocumentDB/databaseAccounts/apis/keyspaces/tables/settings/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Update a table throughput. Only applicable to API types: 'cassandra'. Only applicable for setting types: 'throughput'.
Microsoft.DocumentDB/databaseAccounts/apis/keyspaces/tables/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Create or update a table. Only applicable to API types: 'cassandra'.
Microsoft.DocumentDB/databaseAccounts/apis/keyspaces/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Create a keyspace. Only applicable to API types: 'cassandra'.
Microsoft.DocumentDB/databaseAccounts/apis/tables/delete
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Delete a table. Only applicable to API types: 'table'.
Microsoft.DocumentDB/databaseAccounts/apis/tables/settings/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Update a table throughput. Only applicable to API types: 'table'. Only applicable for setting types: 'throughput'.
Microsoft.DocumentDB/databaseAccounts/apis/tables/write
#Description
(Deprecated. Please use resource paths without '/apis/' segment) Create or update a table. Only applicable to API types: 'table'.
Microsoft.DocumentDB/databaseAccounts/backup/action
#Description
Submit a request to trigger external backup operation
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/delete
#Description
Delete a Cassandra keyspace.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables/delete
#Description
Delete a Cassandra table.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables/throughputSettings/migrateToAutoscale/action
#Description
Migrate Cassandra table offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables/throughputSettings/migrateToManualThroughput/action
#Description
Migrate Cassandra table offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables/throughputSettings/write
#Description
Update a Cassandra table throughput.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables/write
#Description
Create or update a Cassandra table.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/throughputSettings/migrateToAutoscale/action
#Description
Migrate Cassandra keyspace offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/throughputSettings/migrateToManualThroughput/action
#Description
Migrate Cassandra keyspace offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/throughputSettings/write
#Description
Update a Cassandra keyspace throughput.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views/delete
#Description
Delete a Cassandra view.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views/throughputSettings/migrateToAutoscale/action
#Description
Migrate Cassandra view offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views/throughputSettings/migrateToManualThroughput/action
#Description
Migrate Cassandra view offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views/throughputSettings/write
#Description
Update a Cassandra view throughput.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views/write
#Description
Create or update a Cassandra view.
Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/write
#Description
Create a Cassandra keyspace.
Microsoft.DocumentDB/databaseAccounts/changeResourceGroup/action
#Description
Change resource group of a database account
Microsoft.DocumentDB/databaseAccounts/chaosFault/action
#Description
Enable, Disable and GetStatus of Chaos Fault
Microsoft.DocumentDB/databaseAccounts/copyJobs/cancel/action
#Description
Cancel container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/copyJobs/complete/action
#Description
Complete an online container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/copyJobs/pause/action
#Description
Pause a container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/copyJobs/resume/action
#Description
Resume container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/copyJobs/write
#Description
Create container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/cancel/action
#Description
Cancel container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/complete/action
#Description
Complete an online container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/pause/action
#Description
Pause a container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/resume/action
#Description
Resume container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/dataTransferJobs/write
#Description
Create container copy job in a database account
Microsoft.DocumentDB/databaseAccounts/delete
#Description
Deletes the database accounts.
Example Resource Log Record #
{
"ActivityStatusValue": "Success",
"ActivitySubstatusValue": "NoContent",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.DocumentDB/databaseAccounts/dwhp3bbd4ccos",
"action": "Microsoft.DocumentDB/databaseAccounts/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.DocumentDB/databaseAccounts/dwhp3bbd4ccos",
"action": "Microsoft.DocumentDB/databaseAccounts/delete",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "5bf10da8-07cc-4cd4-a775-ee34024bf7eb",
"EventDataId": "cbf127ac-0e9a-4820-bb51-5fb37cb020f7",
"EventSubmissionTimestamp": "2026-07-03T01:48:55.1553212Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Information",
"OperationNameValue": "MICROSOFT.DOCUMENTDB/DATABASEACCOUNTS/DELETE",
"Properties": {
"statusCode": "NoContent",
"serviceRequestId": "",
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.DocumentDB/databaseAccounts/dwhp3bbd4ccos",
"message": "Microsoft.DocumentDB/databaseAccounts/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "cbf127ac-0e9a-4820-bb51-5fb37cb020f7",
"eventSubmissionTimestamp": "2026-07-03T01:48:55.1553212Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhp3bbd4ccos",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.DOCUMENTDB",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"activitySubstatusValue": "NoContent"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.DocumentDB/databaseAccounts/dwhp3bbd4ccos",
"message": "Microsoft.DocumentDB/databaseAccounts/delete",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "cbf127ac-0e9a-4820-bb51-5fb37cb020f7",
"eventSubmissionTimestamp": "2026-07-03T01:48:55.1553212Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhp3bbd4ccos",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.DOCUMENTDB",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Success",
"statusCode": "NoContent",
"serviceRequestId": "",
"activitySubstatusValue": "NoContent"
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.DOCUMENTDB",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.DocumentDB/databaseAccounts/disableLongTermProtection/action
#Description
Submit a request to trigger disableLongTermProtection operation
Microsoft.DocumentDB/databaseAccounts/enableLongTermProtection/action
#Description
Submit a request to trigger enableLongTermProtection operation
Microsoft.DocumentDB/databaseAccounts/failoverPriorityChange/action
#Description
Change failover priorities of regions of a database account. This is used to perform manual failover operation
Microsoft.DocumentDB/databaseAccounts/getBackupPolicy/action
#Description
Get the backup policy of database account
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/delete
#Description
Delete a Gremlin database.
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs/delete
#Description
Delete a Gremlin graph.
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs/throughputSettings/migrateToAutoscale/action
#Description
Migrate Gremlin graph offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs/throughputSettings/migrateToManualThroughput/action
#Description
Migrate Gremlin graph offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs/throughputSettings/write
#Description
Update a Gremlin graph throughput.
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs/write
#Description
Create or update a Gremlin graph.
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/throughputSettings/migrateToAutoscale/action
#Description
Migrate Gremlin Database offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/throughputSettings/migrateToManualThroughput/action
#Description
Migrate Gremlin Database offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/throughputSettings/write
#Description
Update a Gremlin database throughput.
Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/write
#Description
Create a Gremlin database.
Microsoft.DocumentDB/databaseAccounts/joinPerimeter/action
#Description
Joins a database account to a Network Security Perimeter
Microsoft.DocumentDB/databaseAccounts/listConnectionStrings/action
#Description
Get the connection strings for a database account
Microsoft.DocumentDB/databaseAccounts/listKeys/action
#Description
List keys of a database account
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1003
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/delete
#Description
Delete a MongoDB collection.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/partitionMerge/action
#Description
Merge the physical partitions of a MongoDB collection
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/throughputSettings/migrateToAutoscale/action
#Description
Migrate MongoDB collection offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/throughputSettings/migrateToManualThroughput/action
#Description
Migrate MongoDB collection offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/throughputSettings/redistributeThroughput/action
#Description
Redistribute throughput for the specified physical partitions of the MongoDB collection.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/throughputSettings/retrieveThroughputDistribution/action
#Description
Retrieve throughput for the specified physical partitions of the MongoDB collection.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/throughputSettings/write
#Description
Update a MongoDB collection throughput.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections/write
#Description
Create or update a MongoDB collection.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/delete
#Description
Delete a MongoDB database.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/throughputSettings/migrateToAutoscale/action
#Description
Migrate MongoDB database offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/throughputSettings/migrateToManualThroughput/action
#Description
Migrate MongoDB database offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/throughputSettings/redistributeThroughput/action
#Description
Redistribute throughput for the specified physical partitions of the MongoDB database.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/throughputSettings/retrieveThroughputDistribution/action
#Description
Retrieve throughput for the specified physical partitions of the MongoDB database.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/throughputSettings/write
#Description
Update a MongoDB database throughput.
Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/write
#Description
Create a MongoDB database.
Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/delete
#Description
Delete a MongoDB Role Definition
Microsoft.DocumentDB/databaseAccounts/mongodbRoleDefinitions/write
#Description
Create or update a Mongo Role Definition
Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/delete
#Description
Delete a MongoDB User Definition
Microsoft.DocumentDB/databaseAccounts/mongodbUserDefinitions/write
#Description
Create or update a MongoDB User Definition
Microsoft.DocumentDB/databaseAccounts/networkSecurityPerimeterAssociationProxies/delete
#Description
Deletes association proxies related to network security perimeter
Microsoft.DocumentDB/databaseAccounts/networkSecurityPerimeterAssociationProxies/write
#Description
Write association proxies related to network security perimeter
Microsoft.DocumentDB/databaseAccounts/notebookWorkspaces/delete
#Description
Delete a notebook workspace
Microsoft.DocumentDB/databaseAccounts/notebookWorkspaces/listConnectionInfo/action
#Description
List the connection info for a notebook workspace
Microsoft.DocumentDB/databaseAccounts/notebookWorkspaces/write
#Description
Create or update a notebook workspace
Microsoft.DocumentDB/databaseAccounts/offlineRegion/action
#Description
Offline a region of a database account.
Microsoft.DocumentDB/databaseAccounts/onlineRegion/action
#Description
Online a region of a database account.
Microsoft.DocumentDB/databaseAccounts/preBackup/action
#Description
Submit a request to trigger external preBackup operation
Microsoft.DocumentDB/databaseAccounts/preRestore/action
#Description
Submit a request to trigger external preRestore operation
Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionProxies/delete
#Description
Delete a private endpoint connection proxy of Database Account
Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionProxies/validate/action
#Description
Validate a private endpoint connection proxy of Database Account
Microsoft.DocumentDB/databaseAccounts/privateEndpointConnectionProxies/write
#Description
Create or update a private endpoint connection proxy of Database Account
Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/delete
#Description
Delete a private endpoint connection of a Database Account
Microsoft.DocumentDB/databaseAccounts/privateEndpointConnections/write
#Description
Create or update a private endpoint connection of a Database Account
Microsoft.DocumentDB/databaseAccounts/PrivateEndpointConnectionsApproval/action
#Description
Manage a private endpoint connection of Database Account
Microsoft.DocumentDB/databaseAccounts/providers/Microsoft.Insights/diagnosticSettings/write
#Description
Creates or updates the diagnostic setting for the resource
Microsoft.DocumentDB/databaseAccounts/readonlykeys/action
#Description
Reads the database account readonly keys.
Microsoft.DocumentDB/databaseAccounts/refreshDelegatedResourceIdentity/action
#Description
Update existing delegate resources on database account.
Microsoft.DocumentDB/databaseAccounts/regenerateKey/action
#Description
Rotate keys of a database account
Microsoft.DocumentDB/databaseAccounts/restore/action
#Description
Submit a request to trigger external restore operation
Microsoft.DocumentDB/databaseAccounts/services/delete
#Description
Deletes a CosmosDB Service Resource
Microsoft.DocumentDB/databaseAccounts/services/write
#Description
Writes a CosmosDB Service Resource
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/clientEncryptionKeys/write
#Description
Create or update a Client Encryption Key.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/delete
#Description
Delete a SQL container.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/partitionMerge/action
#Description
Merge the physical partitions of a SQL container.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/storedProcedures/delete
#Description
Delete a SQL stored procedure.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/storedProcedures/write
#Description
Create or update a SQL stored procedure.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/throughputSettings/migrateToAutoscale/action
#Description
Migrate SQL container offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/throughputSettings/migrateToManualThroughput/action
#Description
Migrate a SQL container throughput offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/throughputSettings/redistributeThroughput/action
#Description
Redistribute throughput for the specified physical partitions of the SQL container.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/throughputSettings/retrieveThroughputDistribution/action
#Description
Retrieve throughput information for each physical partition of the SQL container.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/throughputSettings/write
#Description
Update a SQL container throughput.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/triggers/delete
#Description
Delete a SQL trigger.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/triggers/write
#Description
Create or update a SQL trigger.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/userDefinedFunctions/delete
#Description
Delete a SQL user defined function.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/userDefinedFunctions/write
#Description
Create or update a SQL user defined function.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/write
#Description
Create or update a SQL container.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/delete
#Description
Delete a SQL database.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/throughputSettings/migrateToAutoscale/action
#Description
Migrate SQL database offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/throughputSettings/migrateToManualThroughput/action
#Description
Migrate a SQL database throughput offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/throughputSettings/redistributeThroughput/action
#Description
Redistribute throughput for the specified physical partitions of the database.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/throughputSettings/retrieveThroughputDistribution/action
#Description
Retrieve throughput information for each physical partition of the database.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/throughputSettings/write
#Description
Update a SQL database throughput.
Microsoft.DocumentDB/databaseAccounts/sqlDatabases/write
#Description
Create a SQL database.
Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/delete
#Description
Delete a SQL Role Assignment
Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments/write
#Description
Create or update a SQL Role Assignment
Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/delete
#Description
Delete a SQL Role Definition
Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions/write
#Description
Create or update a SQL Role Definition
Microsoft.DocumentDB/databaseAccounts/tables/delete
#Description
Delete a table.
Microsoft.DocumentDB/databaseAccounts/tables/throughputSettings/migrateToAutoscale/action
#Description
Migrate table offer to autoscale.
Microsoft.DocumentDB/databaseAccounts/tables/throughputSettings/migrateToManualThroughput/action
#Description
Migrate table offer to manual throughput.
Microsoft.DocumentDB/databaseAccounts/tables/throughputSettings/write
#Description
Update a table throughput.
Microsoft.DocumentDB/databaseAccounts/tables/write
#Description
Create or update a table.
Microsoft.DocumentDB/databaseAccounts/validateForLongTermProtection/action
#Description
Submit a request to trigger validateForLongTermProtection operation
Microsoft.DocumentDB/databaseAccounts/write
#Description
Update a database accounts.
Example Resource Log Record #
{
"ActivityStatusValue": "Failure",
"ActivitySubstatusValue": "Conflict",
"Authorization": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.DocumentDB/databaseAccounts/dwhp3bbd4ccos",
"action": "Microsoft.DocumentDB/databaseAccounts/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Authorization_d": {
"scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.DocumentDB/databaseAccounts/dwhp3bbd4ccos",
"action": "Microsoft.DocumentDB/databaseAccounts/write",
"evidence": {
"role": "Owner",
"roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
"roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
"roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
"principalId": "aaaaaaaa000000000000000000000001",
"principalType": "User"
}
},
"Caller": "adminuser@example.onmicrosoft.com",
"CallerIpAddress": "203.0.113.10",
"CategoryValue": "Administrative",
"Claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"idtyp": "user",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"puid": "1111111111111111",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282"
},
"Claims_d": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
"iat": "1783041418",
"nbf": "1783041418",
"exp": "1783045937",
"aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
"appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
"appidacr": "0",
"idtyp": "user",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
"rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
"http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
"uti": "tUdFU6nO4UmtUjpbHDqEAA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
"xms_act_fct": "3 5",
"xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
"xms_idrel": "1 6",
"xms_sub_fct": "3 4",
"xms_tcdt": "1768616282",
"groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
"ipaddr": "203.0.113.10",
"name": "Admin User",
"puid": "1111111111111111",
"sid": "0022840a-e4ab-884c-587f-d20d24637227",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
},
"CorrelationId": "23855390-8c42-446a-a452-5f2cac1de6c3",
"EventDataId": "0ac72a12-d98b-4239-abff-122c4975d09e",
"EventSubmissionTimestamp": "2026-07-03T01:48:53.9809263Z",
"HTTPRequest": {
"clientIpAddress": "203.0.113.10"
},
"Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"Level": "Error",
"OperationNameValue": "MICROSOFT.DOCUMENTDB/DATABASEACCOUNTS/WRITE",
"Properties": {
"statusCode": "Conflict",
"serviceRequestId": "",
"statusMessage": {
"error": {
"code": "MissingSubscriptionRegistration",
"message": "The subscription is not registered to use namespace 'Microsoft.DocumentDB'. See https://aka.ms/rps-not-found for how to register subscriptions.",
"details": [
{
"code": "MissingSubscriptionRegistration",
"target": "Microsoft.DocumentDB",
"message": "The subscription is not registered to use namespace 'Microsoft.DocumentDB'. See https://aka.ms/rps-not-found for how to register subscriptions."
}
]
}
},
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.DocumentDB/databaseAccounts/dwhp3bbd4ccos",
"message": "Microsoft.DocumentDB/databaseAccounts/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "0ac72a12-d98b-4239-abff-122c4975d09e",
"eventSubmissionTimestamp": "2026-07-03T01:48:53.9809263Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhp3bbd4ccos",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.DOCUMENTDB",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Failure",
"activitySubstatusValue": "Conflict"
},
"Properties_d": {
"eventCategory": "Administrative",
"entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.DocumentDB/databaseAccounts/dwhp3bbd4ccos",
"message": "Microsoft.DocumentDB/databaseAccounts/write",
"hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
"caller": "adminuser@example.onmicrosoft.com",
"eventDataId": "0ac72a12-d98b-4239-abff-122c4975d09e",
"eventSubmissionTimestamp": "2026-07-03T01:48:53.9809263Z",
"httpRequest": {
"clientIpAddress": "203.0.113.10"
},
"resource": "dwhp3bbd4ccos",
"resourceGroup": "rg-logcapture-gen",
"resourceProviderValue": "MICROSOFT.DOCUMENTDB",
"subscriptionId": "22222222-2222-2222-2222-222222222222",
"activityStatusValue": "Failure",
"statusCode": "Conflict",
"serviceRequestId": "",
"activitySubstatusValue": "Conflict",
"statusMessage": {
"error": {
"code": "MissingSubscriptionRegistration",
"message": "The subscription is not registered to use namespace 'Microsoft.DocumentDB'. See https://aka.ms/rps-not-found for how to register subscriptions.",
"details": [
{
"code": "MissingSubscriptionRegistration",
"target": "Microsoft.DocumentDB",
"message": "The subscription is not registered to use namespace 'Microsoft.DocumentDB'. See https://aka.ms/rps-not-found for how to register subscriptions."
}
]
}
}
},
"ResourceGroup": "rg-logcapture-gen",
"ResourceProviderValue": "MICROSOFT.DOCUMENTDB",
"SubscriptionId": "22222222-2222-2222-2222-222222222222"
}
Microsoft.DocumentDB/fleets/delete
#Description
Deletes the Fleet resource
Microsoft.DocumentDB/fleets/fleetAnalytics/delete
#Description
Deletes the FleetAnalytics resource under a Fleet resource
Microsoft.DocumentDB/fleets/fleetAnalytics/write
#Description
Create/Update a FleetAnalytics resource under a Fleet resource
Microsoft.DocumentDB/fleets/fleetspaces/delete
#Description
Deletes the Fleetspace resource under a Fleet resource
Microsoft.DocumentDB/fleets/fleetspaces/fleetspaceAccounts/delete
#Description
Deletes the FleetspaceAccount resource under a Fleetspace resource
Microsoft.DocumentDB/fleets/fleetspaces/fleetspaceAccounts/write
#Description
Create/Update a FleetspaceAccount resource under a Fleetspace resource
Microsoft.DocumentDB/fleets/fleetspaces/write
#Description
Create/Update a Fleetspace resource under a Fleet resource
Microsoft.DocumentDB/fleets/write
#Description
Create/Update a Fleet resource
Microsoft.DocumentDB/locations/deleteVirtualNetworkOrSubnets/action
#Description
Notifies Microsoft.DocumentDB that VirtualNetwork or Subnet is being deleted
Microsoft.DocumentDB/locations/notifyNetworkSecurityPerimeterUpdatesAvailable/action
#Description
Notifies Microsoft.DocumentDB that updates are available for networksecurityperimeter
Microsoft.DocumentDB/locations/restorableDatabaseAccounts/restore/action
#Description
Submit a restore request
Microsoft.DocumentDB/managedResources/delete
#Description
Deletes the managed resource
Microsoft.DocumentDB/managedResources/write
#Description
Create/Update a managed resource
Microsoft.DocumentDB/mongoClusters/delete
#Description
Deletes the specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/firewallRules/delete
#Description
Deletes an existing firewall rule for the specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/firewallRules/write
#Description
Create or Update a firewall rule on a specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/listConnectionStrings/action
#Description
List connection strings for a given Mongo Cluster
Microsoft.DocumentDB/mongoClusters/privateEndpointConnectionProxies/delete
#Description
Deletes an existing private endpoint connection proxy for the specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/privateEndpointConnectionProxies/validate/action
#Description
Validates private endpoint connection proxy for the specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/privateEndpointConnectionProxies/write
#Description
Create or Update a private endpoint connection proxy on a specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/privateEndpointConnections/delete
#Description
Deletes an existing private endpoint connection for the specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/privateEndpointConnections/write
#Description
Create or Update a private endpoint connection on a specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/PrivateEndpointConnectionsApproval/action
#Description
Manage a private endpoint connection of Mongo Cluster
Microsoft.DocumentDB/mongoClusters/promote/action
#Description
Promotes the specified Mongo Cluster replica to be the primary cluster.
Microsoft.DocumentDB/mongoClusters/users/delete
#Description
Deletes an existing user for the specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/users/write
#Description
Create or Update a user on a specified Mongo Cluster.
Microsoft.DocumentDB/mongoClusters/write
#Description
Create or Update the properties or tags of the specified Mongo Cluster.
Microsoft.DocumentDB/register/action
#Description
Register the Microsoft DocumentDB resource provider for the subscription
Microsoft.DocumentDB/throughputPool/throughputPoolAccounts/write
#Description
Create/Update/Delete throughputPool account in throughputPool
Microsoft.DocumentDB/throughputPools/write
#Description
Create/Update/Delete throughputPool