Azure Automation - Scheduled Runbook executions are not recorded in Activity Log

Question

Azure Automation - Scheduled Runbook executions are not recorded in Activity Log

Dey, Dipronil 0

Hi Microsoft Team,

I have an Azure Automation Account with a published runbook that is linked to a schedule.

When I manually start the runbook, I can see an entry in the Activity Log (under the Automation Account) indicating that the runbook was started.

However, when the same runbook is triggered by the linked schedule, the runbook executes successfully and I can see the corresponding job under Automation Account → Jobs, but no entry is generated in the Azure Activity Log.

My questions are:

Is this expected behavior?
Should scheduled runbook executions generate Activity Log events similar to manual runbook executions?
If not, what is the Microsoft-recommended way to audit scheduled runbook executions?
Is there any way to have scheduled executions appear in the Activity Log, or is configuring Diagnostic Settings (for example, sending logs to a Log Analytics Workspace) the only supported approach?

I would appreciate any clarification on the expected behavior and the recommended auditing mechanism for scheduled runbook executions.

Suchitra Suregaunkar 16,125 Microsoft External Staff Moderator

Hello Dey, Dipronil

Thanks for the detailed description of the issue.

The behavior you're seeing is actually by design, and the difference between "manual start" and "schedule start" comes down to how the Azure Activity Log works versus how Azure Automation emits job telemetry.

Let me address each of your questions.

Is this expected behavior? --> Yes, this is expected.

The Azure Activity Log is a control-plane / subscription-level log. It records Azure Resource Manager (ARM) operations performed against a resource by a user, service principal, or managed identity (create, update, delete, action operations, etc.).

When you manually start a runbook from the portal, PowerShell, CLI, REST, or a webhook you invoke, that action is an ARM write operation against the Automation Account (e.g., Microsoft.Automation/automationAccounts/jobs/write). Because it is an ARM call made by an identity, it is captured in the Activity Log.
When the runbook is started by an attached schedule, the job is created internally by the Azure Automation service itself as part of the runbook execution lifecycle. It is not an ARM call initiated by a user or a managed identity, so it is not surfaced in the Activity Log. The job itself is still created and tracked, which is why you correctly see it under Automation Account → Jobs.

Should scheduled runbook executions generate Activity Log events similar to manual runbook executions?

No. Activity Log is not the intended telemetry surface for runbook job execution, it is intended for management-plane operations on the Automation Account resource. Manual starts appear there only as a side-effect of being an ARM operation initiated by a caller. Scheduled starts are triggered by the Automation service's internal scheduler and therefore aren't logged there. This is consistent across Azure services where platform-triggered actions don't produce Activity Log entries.

Microsoft-recommended way to audit scheduled runbook executions:

The supported and recommended path is to forward Azure Automation diagnostic logs to Azure Monitor (Log Analytics workspace, Storage account, or Event Hub) using Diagnostic settings on the Automation Account.

The categories you can enable are:

Category	What it captures
JobLogs	Status of every runbook job in the Automation account (queued, started, completed, failed, suspended) — this is what you want for auditing scheduled executions.
--------	--------
JobLogs	Status of every runbook job in the Automation account (queued, started, completed, failed, suspended) — this is what you want for auditing scheduled executions.
JobStreams	Output/Error/Warning/Verbose/Progress streams produced during job execution.
AuditEvent	Resource logs recording customer interactions with data or settings of the Azure Automation service.
DSCNodeStatus	DSC node status (if you use DSC).
AllMetrics	Total jobs, update deployment runs, etc.

Both manually started jobs and schedule-triggered jobs are captured in JobLogs, so this gives you a single, consistent audit trail regardless of how the job was started.

Is Diagnostic Settings the only supported approach?

Yes — for a complete and consistent audit of every runbook execution (manual + scheduled), configuring Diagnostic settings on the Automation Account and routing the logs to a Log Analytics workspace (or Storage / Event Hub) is the only supported approach. Activity Log will remain limited to ARM operations against the Automation Account and will not include scheduler-initiated jobs.

Please look into below steps to configure on Azure portal:

Go to your Automation Account → Monitoring → Diagnostic settings.
Click Add diagnostic setting.
Give it a name and select the log categories — at minimum JobLogs (and JobStreams if you also want stream-level detail, plus AuditEvent for asset create/modify/delete auditing).
Choose the destination — typically Send to Log Analytics workspace.
Save.

Sample KQL to audit scheduled executions:

Once logs are flowing, you can query in Log Analytics:

AzureDiagnostics
| where ResourceProvider == "MICROSOFT.AUTOMATION"
| where Category == "JobLogs"
| project TimeGenerated, RunbookName_s, ResultType, JobId_g, _ResourceId
| order by TimeGenerated desc

ResultType will show values such as Started, Completed, Failed, Suspended, giving you the full lifecycle of both manual and scheduled jobs.

References:

Forward Azure Automation job data to Azure Monitor logs — learn.microsoft.com/en-us/azure/automation/automation-manage-send-joblogs-log-analytics
Runbook execution in Azure Automation — learn.microsoft.com/en-us/azure/automation/automation-runbook-execution
Manage runbooks in Azure Automation — learn.microsoft.com/en-us/azure/automation/manage-runbooks

Hope this clarifies the behavior. If the answer helped, please mark it as "Upvote" so it can help other community members with the same question.

Thanks,

Suchitra.

1 answer

Your answer

Answer 1

Microsoft states that all runbook execution actions are written to the Automation account Activity Log as “Create an Azure Automation job”; it documents no exception for scheduled starts. Activity Log entries are usually available within 3–20 minutes, and the blade from a resource opens with that resource scoped.

Check the subscription Activity Log, widen the time range, clear caller/resource filters, and select that operation. With PowerShell, filter Authorization.Action for Microsoft.Automation/automationAccounts/jobs/write. Correlate the job resource with Automation Account > Jobs. If the event remains absent, Activity Log is platform-generated; record the job ID and UTC time and ask Microsoft Support to investigate.

For future execution auditing, configure Automation diagnostic settings to send JobLogs to Log Analytics and add JobStreams when output is needed. JobLogs include runbook name, job ID, timestamp, status, and caller; scheduled jobs report system as caller. Query Created, Started, Completed, Failed, Stopped, and Suspended, then build alerts.