Microsoft implements this Audit and Accountability control
Name/Id: ACF1109 / Microsoft Managed Control 1109 Category: Audit and Accountability Title: Content Of Audit Records | Centralized Management Of Planned Audit Record Content Ownership: Customer, Microsoft Description: The information system provides centralized management and configuration of the content to be captured in audit records generated by all network, data storage, and computing devices. Requirements: Azure provides centralized management and configuration of audit record generation through Geneva Monitoring, the central audit management tool, and a variety of detection and reporting services, including Kusto and Jarvis, which aggregate audit log information collected at the Azure asset level. Azure monitors all assets with these tools to ensure compliance with Azure configuration settings and Security Development Lifecycle (SDL) reviews, including audit log settings.
Rule resource types
IF (2) Microsoft.Resources/subscriptions Microsoft.Resources/subscriptions/resourceGroups