The following are the operation names in diagnostic logs for different operations: RegionAddStart, RegionAddComplete RegionRemoveStart, RegionRemoveComplete AccountDeleteStart, AccountDeleteComplete RegionFailoverStart, RegionFailoverComplete AccountCreateStart, AccountCreateComplete *AccountUpdateStart*, AccountUpdateComplete VirtualNetworkDeleteStart, VirtualNetworkDeleteComplete DiagnosticLogUpdateStart, DiagnosticLogUpdateComplete Reference: https://docs.microsoft.com/en-us/azure/cosmos-db/audit-control-plane-logs