Q. How can I look at audit logs for Azure using PowerShell?
A. The Get-AzureRmLog will show logs for a certain resource group from a given time. This can then be searched for certain actions. For example to find all VMs started in the last hour I can use:
Get-AzureRmLog -ResourceGroup $rgname -StartTime (Get-Date).AddHours(-1) | Where-Object OperationName -eq Microsoft.Compute/virtualMachines/start/action