• AUDIT
  • SECURITY
  • REPORT
  • HUMAN

How to track user activity with your AI client

Connect your Azure Log Analytics Workspace to your AI client. Once connected, you can pull specific audit logs using natural language.

Ask AI about this page

Short answer

How can I track user activity with my AI?

You can query your Azure Log Analytics logs by asking your AI to filter for specific user IDs, roles, or timestamps. This lets you pinpoint exact access attempts or actions without writing manual KQL queries. You'll see the specific audit trails and patterns below.

The results you get.

Where your audit data lands.

The AI processes raw log data into clear, actionable insights.

AUDIT

User action history

The AI pulls specific event sequences from your logs. You get a clear timeline of what users did and when.

SECURITY

Access attempt tracking

Identify failed logins or unauthorized role attempts. Your AI flags these specific entries from the workspace.

REPORT

Activity summaries

Turn massive log files into concise lists. You get grouped data based on the roles or IDs you specify.

HUMAN

Manual investigation

The AI identifies the suspicious logs for you. You decide if those specific entries require a security response.

The workflow

What your AI does when the logs arrive.

The AI acts as a bridge between your natural language questions and the Azure data.

  1. Identify target logs

    The AI scans your workspace to find the relevant log entries that match your request.

    query_logs

  2. Filter by user

    It narrows down the data to specific user IDs or assigned roles you mention in chat.

    query_logs

  3. Isolate access events

    The AI pulls out specific access attempts, such as failed logins or permission changes.

    query_logs

  4. Present findings

    The AI organizes the raw log data into a readable format for your review.

    query_logs

Try it

Copy these to start.

Use these prompts to begin auditing your logs.

Starting points

Swap out the bracketed text for your actual user IDs or specific role names.

Azure Log Analytics Workspace Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_h8mzxcilFYlijQMfr5u3GIGk82xs7W4r1G5Um6EK/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Azure Log Analytics Workspace capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "azure-log-analytics-workspace-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_h8mzxcilFYlijQMfr5u3GIGk82xs7W4r1G5Um6EK/mcp"
    }
  }
}
Copy into chat04

  • Show me all recent access attempts for user ID [user_id].

  • List all actions performed by users with the [role_name] role.

  • Find any failed login attempts in the last 24 hours.

  • Summarize the activity for [user_id] from yesterday.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Azure Log Analytics Workspace once, then ask.

Follow the one-click setup to link your workspace. Your credentials stay encrypted and secure on our side.

Connect Azure Log Analytics Workspace to your AI

FAQ

How this task behaves.

  • 01

    Can the AI change my Azure settings?

    No. The AI can only read and query your logs. It cannot modify your Azure configuration or change user permissions.

  • 02

    Does the AI write KQL queries for me?

    Yes. The AI translates your plain English questions into the necessary queries to pull data from your workspace.

  • 03

    Can the AI delete old log entries?

    No. This MCP is read-only. It has no capability to delete, edit, or overwrite any data in your workspace.

  • 04

    How does the AI know which user to look for?

    You tell the AI the specific user ID or role in your prompt, and it uses that to filter the logs.

  • 05

    Can I use this with any AI client?

    Yes, as long as the client supports the Model Context Protocol (MCP).

  • More questions about Azure Log Analytics Workspace? The Connector page answers them. See everything the Azure Log Analytics Workspace Connector can do

Connect Azure Log Analytics Workspace to Claude, Cursor, ChatGPT & more