Azure SQL Database Auditing Policy: ARM Template with Blob Storage Destination

Quick Answer

Reading an auditing configuration in an ARM template comes down to matching each property to what it actually controls, and the storageEndpoint property is the one that determines where audit logs get written. When a template's auditing policy includes a storageEndpoint value alongside state set to Enabled, that combination specifically means the audit feature is turned on and configured to send its logs to an Azure Blob Storage account at that endpoint; that property would not be present or meaningful if the destination were somewhere else, like Log Analytics, which is configured through an entirely different property. The other properties rule out other conclusions: a retentionDays value of 90 means logs are kept for a fixed 90-day window, not indefinitely, so any option claiming permanent retention is wrong. The presence of an explicit auditActionsAndGroups list means the template is defining specific categories of actions to audit rather than falling back on whatever default set SQL Database would otherwise use. The general skill here is reading an ARM template's auditing block property by property rather than assuming one overall behavior: state tells you whether auditing is on, storageEndpoint tells you the destination, retentionDays tells you retention length, and the action list tells you whether defaults are in effect. Look at each property individually rather than inferring behavior from the feature's name alone.