Merge pull request #114318 from Amrinder-Singh29/patch-80

Update blob-storage-monitoring-scenarios.md

Author: Court72

articles/storage/blobs/blob-storage-monitoring-scenarios.md

@@ -124,9 +124,12 @@ For the "when" portion of your audit, the `TimeGenerated` field shows when the l
 For the "what" portion of your audit, the `Uri` field shows the item was modified or read.
 
 For the "how" portion of your audit, the `OperationName` field shows which operation was executed.
-
+> [!TIP] 
+> For example, if you suspect that a blob or container has been deleted by mistake, then add a `where` clause that returns only log entries where the `OperationName` is set to either [Delete blob](/rest/api/storageservices/delete-blob) or [Delete Container](/rest/api/storageservices/delete-container).
 For the "who" portion of your audit, `AuthenticationType` shows which type of authentication was used to make a request. This field can show any of the types of authentication that Azure Storage supports including the use of an account key, a SAS token, or Azure Active Directory (Azure AD) authentication.
 
+If the request is authorized by using Azure AD, you can use the `RequestObjectId` field to identify the "who". Shared Key and SAS authentication provide no means of auditing individual identities. In those cases, the `callerIPAddress` and `userAgentHeader` fields might help you to identify the source of the operation. If a SAS token was used to authorize an operation, you can identify that token, and if you've mapped tokens to token recipients at your end, you can identify which user, organization, or application has performed the operation. See [Identifying the SAS token used to authorize a request](#identifying-the-sas-token-used-to-authorize-a-request).
+
 #### Identifying the security principal used to authorize a request
 
 If a request was authenticated by using Azure AD, the `RequesterObjectId` field provides the most reliable way to identify the security principal. You can find the friendly name of that security principal by taking the value of the `RequesterObjectId` field, and searching for the security principal in Azure AD page of the Azure portal. The following screenshot shows a search result in Azure AD.