Add activity log diagnostic setting

Author: johndowns

articles/azure-resource-manager/bicep/scenarios-monitoring.md

@@ -22,17 +22,27 @@ You can create Log Analytics workspaces with the resource type [Microsoft.Operat
 
 ## Diagnostic settings
 
+Diagnostic settings enable you to configure Azure Monitor to export your logs and metrics to a number of destinations, including Log Analytics and Azure Storage.
+
 When creating [diagnostic settings](../../azure-monitor/essentials/diagnostic-settings.md) in Bicep, remember that this resource is an [extension resource](scope-extension-resources.md), which means it's applied to another resource. You can create diagnostic settings in Bicep by using the resource type [Microsoft.Insights/diagnosticSettings](/azure/templates/microsoft.insights/diagnosticsettings?tabs=bicep).
 
-When creating diagnostic settings in Bicep, you need to apply the scope of the diagnostic setting. The scope can be applied at the management, subscription, or resource group level. [Use the scope property on this resource to set the scope for this resource](../../azure-resource-manager/bicep/scope-extension-resources.md). 
+When creating diagnostic settings in Bicep, you need to apply the scope of the diagnostic setting. The diagnostic setting can be applied at the management, subscription, or resource group level. [Use the scope property on this resource to set the scope for this resource](../../azure-resource-manager/bicep/scope-extension-resources.md). 
 
 Consider the following example:
 
 ::: code language="bicep" source="~/azure-docs-bicep-samples/samples/scenarios-monitoring/diagnostic-settings.bicep" :::
 
 In the preceding example, you create a diagnostic setting for the App Service plan and send those diagnostics to Log Analytics. You can use the `scope` property to define your App Service plan as the scope for your diagnostic setting, and use the `workspaceId` property to define the Log Analytics workspace to send the diagnostic logs to. You can also export diagnostic settings to Event Hubs and Azure Storage Accounts.
 
-Diagnostic settings differ between resources, so ensure that the diagnostic settings you want to create are applicable for the resource you're using.
+Log types differ between resources, so ensure that the logs you want to export are applicable for the resource you're using.
+
+### Activity log diagnostic settings
+
+To use Bicep to configure diagnostic settings to export the Azure activity log, deploy a diagnostic setting resource at the [subscription scope](deploy-to-subscription.md).
+
+The following example shows how to export several activity log types to a Log Analytics workspace:
+
+::: code language="bicep" source="temp/diagnostic-settings-activity-log.bicep" :::
 
 ## Alerts
 

articles/azure-resource-manager/bicep/temp/diagnostic-settings-activity-log.bicep

@@ -0,0 +1,46 @@
+targetScope = 'subscription'
+
+param logAnalyticsWorkspaceId string
+
+var activityLogDiagnosticSettingsName = 'export-activity-log'
+
+resource subscriptionActivityLog 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
+  name: activityLogDiagnosticSettingsName
+  properties: {
+    workspaceId: logAnalyticsWorkspaceId
+    logs: [
+      {
+        category: 'Administrative'
+        enabled: true
+      }
+      {
+        category: 'Security'
+        enabled: true
+      }
+      {
+        category: 'ServiceHealth'
+        enabled: true
+      }
+      {
+        category: 'Alert'
+        enabled: true
+      }
+      {
+        category: 'Recommendation'
+        enabled: true
+      }
+      {
+        category: 'Policy'
+        enabled: true
+      }
+      {
+        category: 'Autoscale'
+        enabled: true
+      }
+      {
+        category: 'ResourceHealth'
+        enabled: true
+      }
+    ]
+  }
+}