How can I find out who created a user in Azure from a year ago?

Nope, sorry! Azure's audit logs only keep user creation data for 30 days. Unless you set up a retention policy or sent the logs to a storage account ahead of time, there's no way to find out who created that user a year ago. You might want to reach out to Microsoft support if you need more options.

Unfortunately, you can't access user creation logs from over 30 days ago. The audit log retention period is quite limited, so unless you’ve stored the logs elsewhere, there isn't a way to retrieve that info after a year. It's a real pain, I know! Maybe consider exporting future logs to a long-term storage or a tool like Log Analytics for better tracking in the future.

This is a common issue! The audit logs time out after 30 days, which means if you didn't keep them somewhere else, you're not going to be able to pull that info after a year. Log Analytics does keep logs for 90 days, but still not enough for your needs this time. Make sure to plan for future log management!

If you haven't done any log retention setup, like using a storage account or Log Analytics, then you're pretty much out of luck after 30 days. It might be worth considering setting something up for the future, so you don't hit this wall again! Just a heads up.