Check below steps in explanation for Task
Explanation:
To collect all the audit failure data from the security log of a virtual machine named VM1 to an Azure Storage account, you can follow these steps:
In the Azure portal, search for and select the virtual machine named VM1.
In the left pane, select Diagnostic settings.
Select Add diagnostic setting.
In the Add diagnostic setting pane, enter the following information:
Name: Enter a name for the diagnostic setting.
Destination: Select Storage account.
Storage account: Select the storage account you want to use.
Logs: Select Windows Event Logs.
Categories: Select Security.
Event types: Select Audit Failure.
Select Save.