topic Re: SQL Audit Logs in Data Warehouse

SQL Audit Logs

FabricH — Fri, 22 Aug 2025 10:02:25 GMT

I tried to enable logging of UPDATE-Statements for the Warehouse (SQL Audits). I don't want to include SELECT-Statements, since this would increasy the volume of actions that are logged.

Bases on the documentation it should be possible (https://learn.microsoft.com/en-us/fabric/data-warehouse/sql-audit-logs#database-level-audit-action-groups-and-actions).

This doesn't work:

--- Begin ---

POST https://api.fabric.microsoft.com/v1/workspaces/<workspace_id>/warehouses/<warehouse_id>/settings/sqlAudit/setAuditActionsAndGroups
content-type: application/json

Authorization: Bearer <bearer_token_here>

[
"UPDATE"
]

--- End ---

However, it might be necessary to specify an object. I couldn't figure out how it works. Did anybody successfully achieve the above and can give me a hint?

Re: SQL Audit Logs

Anonymous — Sat, 23 Aug 2025 06:05:05 GMT

Hi FabricH ,
Thanks for reaching out to the Microsoft fabric community forum.

Please verify if SQL audit logs are enabled using GET request using the same REST Client extension.

The response should return ENABLED.

Also make a note In the extension example code, you must include an empty line immediately after providing the bearer token. This empty line signals the extension where the HTTP headers end and the API command body begins, allowing it to correctly distinguish between the two.

I hope this information helps. Please do let us know if you have any further queries.
Thank you

Re: SQL Audit Logs

FabricH — Tue, 26 Aug 2025 12:48:18 GMT

Thanks. The response returns "enabled".

I included the empty line after the bearer token (somehow removed it in this post).

In general, it works for audit action groups.
However, I am not able to only capture UPDATE statements without capturing SELECT statements.

Re: SQL Audit Logs

Anonymous — Thu, 28 Aug 2025 10:20:29 GMT

Hi FabricH ,

Can you confirm if your Warehouse is using snapshots which is also in preview, there is a limitation where SQL Audit logs is not supported in Warehouse Snapshots.

I hope this information helps. Please do let us know if you have any further queries.
Thank you

Re: SQL Audit Logs

FabricH — Thu, 28 Aug 2025 15:35:33 GMT

Anonymous

No snapshots exist in the warehouse.

Maybe I need to use a different API endpoint (not specified in the documentation).
Since in the documentation, the don't call this "audit action groups", but "individual audit actions".

Re: SQL Audit Logs

Anonymous — Thu, 04 Sep 2025 09:08:58 GMT

Hi FabricH ,
Sorry to know it didn’t help. Please consider reaching out to Microsoft Support. You can provide them with all the troubleshooting steps you've already taken, which will help them understand the issue better and provide a resolution. They might be able to identify something specific about your admin account setup or provide a solution that isn't immediately obvious.

Below is the link to create Microsoft Support ticket:
How to create a Fabric and Power BI Support ticket - Power BI | Microsoft Learn
Thank you

Re: SQL Audit Logs

FabricH — Fri, 05 Sep 2025 13:40:37 GMT

thanks!

Re: SQL Audit Logs

Anonymous — Mon, 08 Sep 2025 05:12:23 GMT

Hi FabricH ,
Could you please confirm if the issue has been resolved after raising a support case? If a solution has been found, it would be greatly appreciated if you could share your insights with the community. This would be helpful for other members who may encounter similar issues.

Thank you for your understanding and assistance.