Learn when to use Activity Log Alerts in Azure

Activity Log Alerts in Azure are used to monitor and get notified about specific events that occur within your Azure subscription. The Azure Activity Log provides a record of all management operations performed on your resources, such as create, update, delete, or other administrative activities. These logs help you track changes to resources, access permissions, and configuration settings.

You would use Activity Log Alerts in the following scenarios:

Monitoring Resource Changes

When to use:

You need to monitor administrative operations such as the creation, modification, or deletion of resources in your Azure subscription.

Example:

Alerts can be set to notify you when a resource is created, deleted, or updated, such as a virtual machine being deleted or an Azure Storage Account being modified.

Use Case:

If an important VM is accidentally deleted, an alert can notify administrators to take corrective action.

Security Monitoring

When to use:

To track potentially unauthorized or suspicious activities in your Azure environment.

Example:

Alert on the assignment of role-based access control (RBAC) roles, particularly when sensitive roles such as Owner, Contributor, or Administrator are assigned to unauthorized users.

Use Case:

If someone assigns an Owner role to an external user or changes the access control settings, an alert can be triggered for review.

Monitoring User and Permission Changes

When to use:

You want to monitor changes related to user access, permissions, and security settings in your Azure subscription.

Example:

Set an alert to notify you when there are changes to Azure Active Directory (AAD) roles or when a new user is added to the Active Directory.

Use Case:

If a user is granted administrative privileges by mistake, an alert can help ensure corrective actions are taken immediately.

Compliance Monitoring

When to use:

You need to track activities that may impact compliance, regulatory requirements, or auditing policies.

Example:

Monitor the creation or deletion of resource groups, changes to security policies, or other configuration changes that might affect compliance standards.

Use Case:

For industries that require strict audit trails (like finance or healthcare), activity log alerts ensure that any unapproved changes are tracked and flagged.

Cost and Resource Management

When to use:

You need to monitor for unexpected resource consumption, resource creation, or deletion that might impact costs.

Example:

Alert on the creation of high-cost resources, such as large virtual machines, or the scaling of App Services.

Use Case:

If a developer accidentally spins up a resource that incurs high costs, such as an expensive VM type, you can be alerted to take appropriate action.

Azure Resource Health and Availability

When to use:

Track changes that could affect the availability or health of critical resources.

Example:

Set alerts for any updates, changes, or operational failures related to services like Azure SQL Database or Azure App Service.

Use Case:

You want to be notified if there is a change in the service plan or availability zone configuration that could impact service availability.

Automated Workflow Triggering

When to use:

Use activity log alerts to trigger automated responses to specific management operations.

Example:

You can set up an alert for when a certain resource is deleted, and trigger an Azure Logic App to send notifications or restore the resource.

Use Case:

Automatically notify a team and take corrective action if a production system is inadvertently deleted.

Monitoring Subscription and Resource Group-Level Changes

When to use:

Track management actions at the subscription or resource group level.

Example:

Set alerts for operations like resource group deletions, subscription modifications, or changes to resource locks.

Use Case:

If someone deletes a resource group by mistake, you can be immediately notified to investigate.

Track Specific Azure Service Events

When to use:

Monitor events that are specific to certain services within Azure.

Example:

You might want to track specific operations on Azure Kubernetes Service (AKS), Azure Functions, or Azure Storage accounts.

Use Case:

Monitor any updates or changes to AKS clusters that might indicate potential issues with deployments or security.

Key Use Cases for Activity Log Alerts

1. Administrative Tracking: Detect who made changes to your Azure resources, when, and what actions were performed (e.g., assigning roles, deleting resources).

2. Security and Compliance: Track actions that could pose security risks, like assigning elevated roles or changing security policies, ensuring that your environment remains compliant with internal or external regulations.

3. Cost Control: Detect the creation of resources that could lead to unexpected costs, enabling you to respond proactively.

4. Resource Availability and Operations: Monitor key operational events in critical services to ensure the health and availability of your environment.

How Activity Log Alerts Work

1. Scope: Activity Log Alerts are scoped to specific actions or events that occur within your Azure subscription or resource group.

2. Filters: When creating an Activity Log Alert, you can define filters for specific event types, such as:

   • Event Category: Administrative, Service Health, Policy, etc.

   • Event Level: Informational, Warning, or Error.

   • Resource Type: Specify if the event is related to a particular Azure service (e.g., Virtual Machines, Storage Accounts).

   • Event ID: You can filter by specific event IDs (e.g., VM creation, deletion, role assignments).

When NOT to Use Activity Log Alerts

1. Monitoring Performance Metrics: Activity Log Alerts are designed to track management events, not operational metrics like CPU usage or network latency. For performance or resource health monitoring, use metric alerts.

2. Log-Search Specific Monitoring: Activity Log Alerts do not provide detailed analysis of logs from applications or infrastructure. For this type of monitoring, use log search alerts or Application Insights.

Summary

Use Activity Log Alerts when you need to track and get notified about management-level events in your Azure environment, such as changes to resources, security configurations, or access permissions. These alerts are critical for security, compliance, cost control, and operational tracking. However, for monitoring specific resource performance or logs generated by applications, consider using metric alerts or log search alerts instead.