How to lookup who created/edited a secret in Azure Portal's Keyvault?

Question

I am trying to lookup who created or changed a secret inside our keyvault on Azure Portal but I'm only able to lookup the date it was created/changed. I found out that there is a way to do it with Activity Logs. The problem is that they enable looking up activities not older than 90 days. Is there another way to do this if the creation/change was done earlier than 90 days?

Answer 1

Unfortunately, the activity logs are available for only 90 days as mentioned below:

There is a way, you can store or send these logs to a Log Analytics Workspace like below:

Now these logs are stored in Log Analytics Workspace, This way you need to do for every 3 months(90 days) then the logs will be stored and you can also store these to a storage account, by this way you can check logs.