microsoft.insights activityLogAlerts 2017-03-01-preview

Remarks

For guidance on deploying monitoring solutions, see Create monitoring resources by using Bicep.

Bicep resource definition

The activityLogAlerts resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Resource format

To create a microsoft.insights/activityLogAlerts resource, add the following Bicep to your template.

resource symbolicname 'microsoft.insights/activityLogAlerts@2017-03-01-preview' = {
  location: 'string'
  name: 'string'
  properties: {
    actions: {
      actionGroups: [
        {
          actionGroupId: 'string'
          webhookProperties: {
            {customized property}: 'string'
          }
        }
      ]
    }
    condition: {
      allOf: [
        {
          equals: 'string'
          field: 'string'
        }
      ]
    }
    description: 'string'
    enabled: bool
    scopes: [
      'string'
    ]
  }
  tags: {
    {customized property}: 'string'
  }
}

Property Values

microsoft.insights/activityLogAlerts

Name Description Value
location Resource location string (required)
name The resource name string (required)
properties An Azure activity log alert. ActivityLogAlert
tags Resource tags Dictionary of tag names and values. See Tags in templates

ActivityLogAlert

Name Description Value
actions The actions that will activate when the condition is met. ActivityLogAlertActionList (required)
condition The condition that will cause this alert to activate. ActivityLogAlertAllOfCondition (required)
description A description of this activity log alert. string
enabled Indicates whether this activity log alert is enabled. If an activity log alert is not enabled, then none of its actions will be activated. bool
scopes A list of resourceIds that will be used as prefixes. The alert will only apply to activityLogs with resourceIds that fall under one of these prefixes. This list must include at least one item. string[] (required)

ActivityLogAlertActionGroup

Name Description Value
actionGroupId The resourceId of the action group. This cannot be null or empty. string (required)
webhookProperties The dictionary of custom properties to include with the post operation. These data are appended to the webhook payload. ActivityLogAlertActionGroupWebhookProperties

ActivityLogAlertActionGroupWebhookProperties

Name Description Value

ActivityLogAlertActionList

Name Description Value
actionGroups The list of activity log alerts. ActivityLogAlertActionGroup[]

ActivityLogAlertAllOfCondition

Name Description Value
allOf The list of activity log alert conditions. ActivityLogAlertLeafCondition[] (required)

ActivityLogAlertLeafCondition

Name Description Value
equals The field value will be compared to this value (case-insensitive) to determine if the condition is met. string (required)
field The name of the field that this condition will examine. The possible values for this field are (case-insensitive): 'resourceId', 'category', 'caller', 'level', 'operationName', 'resourceGroup', 'resourceProvider', 'status', 'subStatus', 'resourceType', or anything beginning with 'properties.'. string (required)

ResourceTags

Name Description Value

Usage Examples

Bicep Samples

A basic example of deploying Activity Log Alert within Azure Monitor.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

resource actionGroup 'Microsoft.Insights/actionGroups@2023-01-01' = {
  name: resourceName
  location: 'global'
  properties: {
    armRoleReceivers: []
    automationRunbookReceivers: []
    azureAppPushReceivers: []
    azureFunctionReceivers: []
    emailReceivers: []
    enabled: true
    eventHubReceivers: []
    groupShortName: 'acctestag1'
    itsmReceivers: []
    logicAppReceivers: []
    smsReceivers: []
    voiceReceivers: []
    webhookReceivers: []
  }
}

resource actionGroup2 'Microsoft.Insights/actionGroups@2023-01-01' = {
  name: resourceName
  location: 'global'
  properties: {
    armRoleReceivers: []
    automationRunbookReceivers: []
    azureAppPushReceivers: []
    azureFunctionReceivers: []
    emailReceivers: []
    enabled: true
    eventHubReceivers: []
    groupShortName: 'acctestag2'
    itsmReceivers: []
    logicAppReceivers: []
    smsReceivers: []
    voiceReceivers: []
    webhookReceivers: []
  }
}

resource activityLogAlert 'Microsoft.Insights/activityLogAlerts@2020-10-01' = {
  name: resourceName
  location: 'global'
  properties: {
    actions: {
      actionGroups: [
        {
          actionGroupId: actionGroup.id
          webhookProperties: {}
        }
        {
          actionGroupId: actionGroup2.id
          webhookProperties: {
            from: 'terraform test'
            to: 'microsoft azure'
          }
        }
      ]
    }
    condition: {
      allOf: [
        {
          equals: 'ResourceHealth'
          field: 'category'
        }
        {
          anyOf: [
            {
              equals: 'Unavailable'
              field: 'properties.currentHealthStatus'
            }
            {
              equals: 'Degraded'
              field: 'properties.currentHealthStatus'
            }
          ]
        }
        {
          anyOf: [
            {
              equals: 'Unknown'
              field: 'properties.previousHealthStatus'
            }
            {
              equals: 'Available'
              field: 'properties.previousHealthStatus'
            }
          ]
        }
        {
          anyOf: [
            {
              equals: 'PlatformInitiated'
              field: 'properties.cause'
            }
            {
              equals: 'UserInitiated'
              field: 'properties.cause'
            }
          ]
        }
      ]
    }
    description: 'This is just a test acceptance.'
    enabled: true
    scopes: [
      resourceGroup().id
      storageAccount.id
    ]
  }
}

resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
  name: resourceName
  location: location
  kind: 'StorageV2'
  properties: {
    accessTier: 'Hot'
    allowBlobPublicAccess: true
    allowCrossTenantReplication: true
    allowSharedKeyAccess: true
    defaultToOAuthAuthentication: false
    encryption: {
      keySource: 'Microsoft.Storage'
      services: {
        queue: {
          keyType: 'Service'
        }
        table: {
          keyType: 'Service'
        }
      }
    }
    isHnsEnabled: false
    isNfsV3Enabled: false
    isSftpEnabled: false
    minimumTlsVersion: 'TLS1_2'
    networkAcls: {
      defaultAction: 'Allow'
    }
    publicNetworkAccess: 'Enabled'
    supportsHttpsTrafficOnly: true
  }
  sku: {
    name: 'Standard_LRS'
  }
}

Azure Verified Modules

The following Azure Verified Modules can be used to deploy this resource type.

Module Description
Activity Log Alert AVM Resource Module for Activity Log Alert

Azure Quickstart Samples

The following Azure Quickstart templates contain Bicep samples for deploying this resource type.

Bicep File Description
AKS Cluster with a NAT Gateway and an Application Gateway This sample shows how to a deploy an AKS cluster with NAT Gateway for outbound connections and an Application Gateway for inbound connections.
AKS cluster with the Application Gateway Ingress Controller This sample shows how to deploy an AKS cluster with Application Gateway, Application Gateway Ingress Controller, Azure Container Registry, Log Analytics and Key Vault
Creates an Azure service alert This template creates an Azure service health alert that optionally sends emails to service administrators and specified email addresses in the event of cerain Azure service outages.

ARM template resource definition

The activityLogAlerts resource type can be deployed with operations that target:

For a list of changed properties in each API version, see change log.

Resource format

To create a microsoft.insights/activityLogAlerts resource, add the following JSON to your template.

{
  "type": "microsoft.insights/activityLogAlerts",
  "apiVersion": "2017-03-01-preview",
  "name": "string",
  "location": "string",
  "properties": {
    "actions": {
      "actionGroups": [
        {
          "actionGroupId": "string",
          "webhookProperties": {
            "{customized property}": "string"
          }
        }
      ]
    },
    "condition": {
      "allOf": [
        {
          "equals": "string",
          "field": "string"
        }
      ]
    },
    "description": "string",
    "enabled": "bool",
    "scopes": [ "string" ]
  },
  "tags": {
    "{customized property}": "string"
  }
}

Property Values

microsoft.insights/activityLogAlerts

Name Description Value
apiVersion The api version '2017-03-01-preview'
location Resource location string (required)
name The resource name string (required)
properties An Azure activity log alert. ActivityLogAlert
tags Resource tags Dictionary of tag names and values. See Tags in templates
type The resource type 'microsoft.insights/activityLogAlerts'

ActivityLogAlert

Name Description Value
actions The actions that will activate when the condition is met. ActivityLogAlertActionList (required)
condition The condition that will cause this alert to activate. ActivityLogAlertAllOfCondition (required)
description A description of this activity log alert. string
enabled Indicates whether this activity log alert is enabled. If an activity log alert is not enabled, then none of its actions will be activated. bool
scopes A list of resourceIds that will be used as prefixes. The alert will only apply to activityLogs with resourceIds that fall under one of these prefixes. This list must include at least one item. string[] (required)

ActivityLogAlertActionGroup

Name Description Value
actionGroupId The resourceId of the action group. This cannot be null or empty. string (required)
webhookProperties The dictionary of custom properties to include with the post operation. These data are appended to the webhook payload. ActivityLogAlertActionGroupWebhookProperties

ActivityLogAlertActionGroupWebhookProperties

Name Description Value

ActivityLogAlertActionList

Name Description Value
actionGroups The list of activity log alerts. ActivityLogAlertActionGroup[]

ActivityLogAlertAllOfCondition

Name Description Value
allOf The list of activity log alert conditions. ActivityLogAlertLeafCondition[] (required)

ActivityLogAlertLeafCondition

Name Description Value
equals The field value will be compared to this value (case-insensitive) to determine if the condition is met. string (required)
field The name of the field that this condition will examine. The possible values for this field are (case-insensitive): 'resourceId', 'category', 'caller', 'level', 'operationName', 'resourceGroup', 'resourceProvider', 'status', 'subStatus', 'resourceType', or anything beginning with 'properties.'. string (required)

ResourceTags

Name Description Value

Usage Examples

Azure Quickstart Templates

The following Azure Quickstart templates deploy this resource type.

Template Description
AKS Cluster with a NAT Gateway and an Application Gateway

Deploy to Azure		 This sample shows how to a deploy an AKS cluster with NAT Gateway for outbound connections and an Application Gateway for inbound connections.
AKS cluster with the Application Gateway Ingress Controller

Deploy to Azure		 This sample shows how to deploy an AKS cluster with Application Gateway, Application Gateway Ingress Controller, Azure Container Registry, Log Analytics and Key Vault
Alert for misconfigured Key Vault on Application Gateway

Deploy to Azure		 Use such templates to easily create some important event alerts for your Azure Application Gateway.
Create a Private AKS Cluster with a Public DNS Zone

Deploy to Azure		 This sample shows how to a deploy a private AKS cluster with a Public DNS Zone.
Creates an Azure service alert

Deploy to Azure		 This template creates an Azure service health alert that optionally sends emails to service administrators and specified email addresses in the event of cerain Azure service outages.
Deploy a Service Health Alert

Deploy to Azure		 This template allows you to deploy a simple alert which uses an action group to send email notifications for any Service Health records in the Azure Activity Log
Deploy an Autoscale Activity Log Alert

Deploy to Azure		 This template allows you to deploy a simple alert which uses an action group to send email notifications for any Autoscale records in the Azure Activity Log
Deploy an Autoscale Failed Activity Log Alert

Deploy to Azure		 This template allows you to deploy a simple alert which uses an action group to send email notifications for any failed Autoscale records in the Azure Activity Log

Terraform (AzAPI provider) resource definition

The activityLogAlerts resource type can be deployed with operations that target:

  • Resource groups

For a list of changed properties in each API version, see change log.

Resource format

To create a microsoft.insights/activityLogAlerts resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "microsoft.insights/activityLogAlerts@2017-03-01-preview"
  name = "string"
  parent_id = "string"
  location = "string"
  tags = {
    {customized property} = "string"
  }
  body = {
    properties = {
      actions = {
        actionGroups = [
          {
            actionGroupId = "string"
            webhookProperties = {
              {customized property} = "string"
            }
          }
        ]
      }
      condition = {
        allOf = [
          {
            equals = "string"
            field = "string"
          }
        ]
      }
      description = "string"
      enabled = bool
      scopes = [
        "string"
      ]
    }
  }
}

Property Values

microsoft.insights/activityLogAlerts

Name Description Value
location Resource location string (required)
name The resource name string (required)
properties An Azure activity log alert. ActivityLogAlert
tags Resource tags Dictionary of tag names and values.
type The resource type "microsoft.insights/activityLogAlerts@2017-03-01-preview"

ActivityLogAlert

Name Description Value
actions The actions that will activate when the condition is met. ActivityLogAlertActionList (required)
condition The condition that will cause this alert to activate. ActivityLogAlertAllOfCondition (required)
description A description of this activity log alert. string
enabled Indicates whether this activity log alert is enabled. If an activity log alert is not enabled, then none of its actions will be activated. bool
scopes A list of resourceIds that will be used as prefixes. The alert will only apply to activityLogs with resourceIds that fall under one of these prefixes. This list must include at least one item. string[] (required)

ActivityLogAlertActionGroup

Name Description Value
actionGroupId The resourceId of the action group. This cannot be null or empty. string (required)
webhookProperties The dictionary of custom properties to include with the post operation. These data are appended to the webhook payload. ActivityLogAlertActionGroupWebhookProperties

ActivityLogAlertActionGroupWebhookProperties

Name Description Value

ActivityLogAlertActionList

Name Description Value
actionGroups The list of activity log alerts. ActivityLogAlertActionGroup[]

ActivityLogAlertAllOfCondition

Name Description Value
allOf The list of activity log alert conditions. ActivityLogAlertLeafCondition[] (required)

ActivityLogAlertLeafCondition

Name Description Value
equals The field value will be compared to this value (case-insensitive) to determine if the condition is met. string (required)
field The name of the field that this condition will examine. The possible values for this field are (case-insensitive): 'resourceId', 'category', 'caller', 'level', 'operationName', 'resourceGroup', 'resourceProvider', 'status', 'subStatus', 'resourceType', or anything beginning with 'properties.'. string (required)

ResourceTags

Name Description Value

Usage Examples

Terraform Samples

A basic example of deploying Activity Log Alert within Azure Monitor.

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}

provider "azapi" {
  skip_provider_registration = false
}

variable "resource_name" {
  type    = string
  default = "acctest0001"
}

variable "location" {
  type    = string
  default = "westeurope"
}

resource "azapi_resource" "resourceGroup" {
  type     = "Microsoft.Resources/resourceGroups@2020-06-01"
  name     = var.resource_name
  location = var.location
}

resource "azapi_resource" "storageAccount" {
  type      = "Microsoft.Storage/storageAccounts@2021-09-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = var.location
  body = {
    kind = "StorageV2"
    properties = {
      accessTier                   = "Hot"
      allowBlobPublicAccess        = true
      allowCrossTenantReplication  = true
      allowSharedKeyAccess         = true
      defaultToOAuthAuthentication = false
      encryption = {
        keySource = "Microsoft.Storage"
        services = {
          queue = {
            keyType = "Service"
          }
          table = {
            keyType = "Service"
          }
        }
      }
      isHnsEnabled      = false
      isNfsV3Enabled    = false
      isSftpEnabled     = false
      minimumTlsVersion = "TLS1_2"
      networkAcls = {
        defaultAction = "Allow"
      }
      publicNetworkAccess      = "Enabled"
      supportsHttpsTrafficOnly = true
    }
    sku = {
      name = "Standard_LRS"
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "actionGroup" {
  type      = "Microsoft.Insights/actionGroups@2023-01-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = "global"
  body = {
    properties = {
      armRoleReceivers = [
      ]
      automationRunbookReceivers = [
      ]
      azureAppPushReceivers = [
      ]
      azureFunctionReceivers = [
      ]
      emailReceivers = [
      ]
      enabled = true
      eventHubReceivers = [
      ]
      groupShortName = "acctestag1"
      itsmReceivers = [
      ]
      logicAppReceivers = [
      ]
      smsReceivers = [
      ]
      voiceReceivers = [
      ]
      webhookReceivers = [
      ]
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "actionGroup2" {
  type      = "Microsoft.Insights/actionGroups@2023-01-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = "global"
  body = {
    properties = {
      armRoleReceivers = [
      ]
      automationRunbookReceivers = [
      ]
      azureAppPushReceivers = [
      ]
      azureFunctionReceivers = [
      ]
      emailReceivers = [
      ]
      enabled = true
      eventHubReceivers = [
      ]
      groupShortName = "acctestag2"
      itsmReceivers = [
      ]
      logicAppReceivers = [
      ]
      smsReceivers = [
      ]
      voiceReceivers = [
      ]
      webhookReceivers = [
      ]
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}

resource "azapi_resource" "activityLogAlert" {
  type      = "Microsoft.Insights/activityLogAlerts@2020-10-01"
  parent_id = azapi_resource.resourceGroup.id
  name      = var.resource_name
  location  = "global"
  body = {
    properties = {
      actions = {
        actionGroups = [
          {
            actionGroupId = azapi_resource.actionGroup.id
            webhookProperties = {
            }
          },
          {
            actionGroupId = azapi_resource.actionGroup2.id
            webhookProperties = {
              from = "terraform test"
              to   = "microsoft azure"
            }
          },
        ]
      }
      condition = {
        allOf = [
          {
            equals = "ResourceHealth"
            field  = "category"
          },
          {
            anyOf = [
              {
                equals = "Unavailable"
                field  = "properties.currentHealthStatus"
              },
              {
                equals = "Degraded"
                field  = "properties.currentHealthStatus"
              },
            ]
          },
          {
            anyOf = [
              {
                equals = "Unknown"
                field  = "properties.previousHealthStatus"
              },
              {
                equals = "Available"
                field  = "properties.previousHealthStatus"
              },
            ]
          },
          {
            anyOf = [
              {
                equals = "PlatformInitiated"
                field  = "properties.cause"
              },
              {
                equals = "UserInitiated"
                field  = "properties.cause"
              },
            ]
          },
        ]
      }
      description = "This is just a test acceptance."
      enabled     = true
      scopes = [
        azapi_resource.resourceGroup.id,
        azapi_resource.storageAccount.id,
      ]
    }
  }
  schema_validation_enabled = false
  response_export_values    = ["*"]
}
  • Last updated on