How to identify the user who manually executed an Azure Data Factory pipeline?

Hi @EWDService ,

Thanks for reaching out Microsoft Q&A

The Monitor tab in ADF Studio does not show who triggered a run. It only shows pipeline status and parameters. To see who manually pressed “Trigger Now”, you have to step outside the Monitor tab and look at control-plane logs, because that’s where the user identity is recorded.

Prerequisites:

If you want to know who pressed Trigger Now on an Azure Data Factory pipeline, you need both Activity Logs and Diagnostics capturing the CreatePipelineRun event. These logs must also be stored somewhere beyond the default 90-day Activity Log retention; otherwise, the information is lost and can’t be reconstructed later.

How to Identify Who Manually Executed a Pipeline

1. Check Azure Activity Logs
   • Go to Azure Activity Logs.
   • Filter for CreatePipelineRun events.
   • Look at the Caller field → this shows the Azure AD UPN/email of the person who manually triggered the pipeline.
2. Enable Diagnostic Logs for Ongoing Tracking
   • In your Data Factory, enable Diagnostic Logs → send PipelineRuns to Log Analytics.
   • This gives you an audit trail you can query anytime with KQL.
3. Understand the Difference
   • Manual runs → Caller shows the actual user’s Azure AD UPN/email.
   • Non-manual runs (scheduled triggers, API, service principals) → Caller shows as the ADF service identity.

Note:

You can’t see the user in Monitor tab.

You can see them in Activity Log → CreatePipelineRun → Caller.

For ongoing tracking, you must enable Diagnostic Logs → Log Analytics, where manual runs will clearly show the user’s Azure AD UPN/email, while automated runs will show the ADF service principal.

References:

• Monitor ADF with Azure Monitor
• Azure Activity Log overview

If you have any further questions, feel free to respond in this same thread.