Back to Checks
azure

Subscription has an Azure Monitor activity log alert for policy assignment creation

monitor_alert_create_policy_assignment
Service: monitorSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.insights/activitylogalerts

Azure Monitor Activity Log alert configurations are assessed for an activity log alert on Microsoft.Authorization/policyAssignments/write, indicating monitoring of newly created Azure Policy assignments

Prowler logoProwlerprowler-provider-azure

Risk

Absent alerts on new policy assignments, unauthorized or accidental changes can silently weaken governance. Adversaries could assign permissive policies or replace deny rules, enabling misconfigurations, privilege expansion, and data exposure-degrading integrity and threatening confidentiality and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks monitor_alert_create_policy_assignment

Recommendation

Implement an activity log alert for Microsoft.Authorization/policyAssignments/write and route to an action group for timely response.

Apply across all subscriptions, restrict assignment rights (least privilege), require change approval, and integrate notifications with your SIEM for defense in depth.

Remediation

CLI

az monitor activity-log alert create --name '<activity log rule name>' --resource-group '<resource group name>' --location global --scopes '/subscriptions/<subscription ID>' --condition "category=Administrative and operationName=Microsoft.Authorization/policyAssignments/write" --enabled true

Terraform

# Azure Monitor Activity Log Alert for Policy Assignment creation
resource "azurerm_monitor_activity_log_alert" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "global"
  scopes              = ["/subscriptions/<subscription ID>"]

  criteria {
    category       = "Administrative" # Critical: Activity Log category
    operation_name = "Microsoft.Authorization/policyAssignments/write" # Critical: Policy Assignment creation
  }
}

NativeIaC

// Azure Monitor Activity Log Alert for Policy Assignment creation
resource activityLogAlert 'Microsoft.Insights/activityLogAlerts@2020-10-01' = {
  name: '<example_resource_name>'
  location: 'global'
  properties: {
    enabled: true
    scopes: [ '/subscriptions/<subscription ID>' ]
    condition: {
      allOf: [
        {
          field: 'category'
          equals: 'Administrative' // Critical: filter Activity Log category to Administrative
        }
        {
          field: 'operationName'
          equals: 'Microsoft.Authorization/policyAssignments/write' // Critical: alert on Policy Assignment creation
        }
      ]
    }
  }
}

Other

1In the Azure Portal, go to Monitor > Alerts > Alert rules
2Click + Create > Alert rule
3Scope: Select the target Subscription and click Apply
4Condition: Choose Activity log, then set Category = Administrative and Operation name = Microsoft.Authorization/policyAssignments/write; click Apply
5Actions: Skip or select an existing Action group (optional)
6Details: Enter a Name and ensure Enable alert rule upon creation is checked
7Click Review + create, then Create

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
from prowler.providers.azure.services.monitor.monitor_client import monitor_client


class monitor_alert_create_policy_assignment(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            activity_log_alerts,
        ) in monitor_client.alert_rules.items():
            subscription_name = monitor_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for alert_rule in activity_log_alerts:
                if check_alert_rule(
                    alert_rule, "Microsoft.Authorization/policyAssignments/write"
                ):
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=alert_rule
                    )
                    report.subscription = subscription_id
                    report.status = "PASS"
                    report.status_extended = f"There is an alert configured for creating Policy Assignments in subscription {subscription_name} ({subscription_id})."
                    break
            else:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status = "FAIL"
                report.status_extended = f"There is not an alert for creating Policy Assignments in subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References