Contact
All systems System

File share audit and alerts

Delete reporting for Azure file shares, built on Azure's own logging and workflow services. A daily report by email lists every delete with who, what, when and from which computer, and alerts arrive within minutes for mass or unusual deletes.

Describe what you need

What you get

  • Delete logging on the shares that matter, kept in Azure with retention that fits your audit needs
  • A daily report by email of every delete: who, what, when and from which computer, or a failure notice if it cannot be built
  • Names in the report: on a domain PC, Windows accounts are looked up in Active Directory
  • Alerts within minutes when a folder tree or a share is deleted, or files are removed with a storage key
  • Alert statuses, acknowledged or resolved, with the name of whoever set them
  • A report page that opens offline on any PC and sends nothing anywhere

How it works

  1. 01

    Choose shares and recipients

    We agree which shares matter most and who should receive the reports and alerts.

  2. 02

    Switch on delete logging

    Delete logging on those shares goes to Log Analytics, with retention set for your audit needs.

  3. 03

    Set up reports and alerts

    The daily report and the alerts are built in Azure from the delete logs, with no extra service to run, and arrive by email.

  4. 04

    Roll out the report page

    The report page goes to the people who need it. One double-click opens it in the browser, and it works offline. It reads the report emails from classic Outlook, from Outlook on the web or from a folder of saved attachments.

Problems it solves

  • ProblemA project folder disappears from the shared drive, and no log exists to show who deleted it.

    SolutionDelete logging is switched on for the shares that matter and kept in Azure, with retention that fits your audit needs.

  • ProblemA bulk delete is noticed days later when someone opens an empty folder, and by then nobody remembers what happened.

    SolutionAn alert arrives within minutes when many files go at once, such as a deleted folder tree or share, so the cause can be checked while it is fresh.

  • ProblemScripts and tools delete files with a shared storage key, so the log shows a key instead of a person.

    SolutionDeletes made with a storage key instead of a person's account raise an alert within minutes, and the daily report shows which computer they came from.

  • ProblemDiagnostic logs are collected and paid for, but nobody turns them into a report a manager or an auditor can use.

    SolutionA daily report by email lists every delete: who, what, when and from which computer. On a domain PC, Windows accounts are looked up in Active Directory, so the report shows the person.

What it covers

  • Azure file shares used as mapped drives
  • For exampleLog Analytics
  • For exampleAzure Logic Apps
  • Failure notice when a report cannot be built
  • Alerts within minutes for mass or unusual deletes
  • Alerts for deletes made with a storage key
  • Account names looked up in Active Directory
  • Alert statuses with the name of whoever set them
  • For exampleOutlook, Microsoft Graph
Typical scope

Built for Azure Files used as a mapped drive. Setup usually takes days rather than weeks. It covers delete logging on the shares that matter, the daily report and alerts, and the report page for the people who need it.

Next step

Send a short description of what you need and the systems involved. We reply with proposed next steps.

Describe what you need