The user is trying to build a notification system for when an ACL is removed on a folder in ADLS Gen2. They find that the current logging does not specify whether an ACL change was a modification or a removal, making it difficult to track changes effectively. They request improved logging to provide more detailed information about ACL changes.
I’m currently banging my head against AzureBlobLogs (StorageBlobLogs) trying to build a basic notification system for when an ACL is removed on a folder in ADLS Gen2. I’m focusing on two operation types: 1.SetPathAccessControlRecursive 2.SetPathAccessControl The Problem: SetPathAccessControlRecursive is at least somewhat helpful because it captures the mode (modify, or remove) within the URI. I can work with that. However, SetPathAccessControl tells me absolutely nothing. It logs the operation, but doesn't specify if it was a modification or a full removal. On top of that, the RequesterObjectId is missing half the time (I was doing acl changes via portal btw) making it impossible to see who did what. I really don't want to resort to building a complex Azure Function or taking scheduled ACL snapshots to do a "before and after" comparison. I want to achieve the bare minimum using just the logs if possible. Has anyone found a clever way to correlate these logs with other signals to get the missing Requester identity? Am I fighting a losing battle trying to use BlobLogs for this level of granularity? Any tips clarifications would be appreciated.