Back to Checks
azure

Azure subscription has an Activity Log alert for public IP address deletion

monitor_alert_delete_public_ip_address_rule
Service: monitorSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:microsoft.insights/activitylogalerts

Azure Monitor activity log alert exists for the Delete Public IP Address operation (Microsoft.Network/publicIPAddresses/delete), capturing subscription-wide events when Public IP resources are removed.

Prowler logoProwlerprowler-provider-azure

Risk

Unmonitored deletion of Public IPs can abruptly sever ingress/egress, break DNS and allowlists, and take services offline (availability). Attackers or misconfigurations can delete IPs to cause DoS or evade controls, and delayed visibility hinders incident response and forensics.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks monitor_alert_delete_public_ip_address_rule

Recommendation

Implement an activity log alert for Microsoft.Network/publicIPAddresses/delete and route it to an action group for rapid response.

  • Apply least privilege and change approval for IP deletions
  • Use resource locks on critical IPs
  • Centralize alerts in your SIEM and define runbooks for containment

Remediation

CLI

az monitor activity-log alert create --name <activity_log_rule_name> --resource-group <resource_group_name> --location global --scopes /subscriptions/<subscription_id> --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/delete

Terraform

resource "azurerm_monitor_activity_log_alert" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  scopes              = ["/subscriptions/<example_resource_id>"]

  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.Network/publicIPAddresses/delete" # Critical: alert when a Public IP is deleted
  }
}

NativeIaC

// Activity Log alert for Public IP deletion
resource alert 'Microsoft.Insights/activityLogAlerts@2020-10-01' = {
  name: '<example_resource_name>'
  location: 'Global'
  properties: {
    enabled: true
    scopes: [
      '/subscriptions/<example_resource_id>' // Scope the alert to the subscription
    ]
    condition: {
      allOf: [
        { field: 'category', equals: 'Administrative' }
        { field: 'operationName', equals: 'Microsoft.Network/publicIPAddresses/delete' } // Critical: triggers when a Public IP is deleted
      ]
    }
  }
}

Other

1In the Azure portal, go to Monitor > Alerts > + Create > Alert rule
2Scope: Select your subscription and click Apply
3Condition: Choose Activity log, then set Category = Administrative and Operation name = Microsoft.Network/publicIPAddresses/delete; click Apply
4Actions: Skip (no action group required to pass)
5Details: Enter an alert name, set Region to Global, ensure Enable alert rule upon creation is checked
6Review + create > Create

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.monitor.lib.monitor_alerts import check_alert_rule
from prowler.providers.azure.services.monitor.monitor_client import monitor_client


class monitor_alert_delete_public_ip_address_rule(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            activity_log_alerts,
        ) in monitor_client.alert_rules.items():
            subscription_name = monitor_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for alert_rule in activity_log_alerts:
                if check_alert_rule(
                    alert_rule, "Microsoft.Network/publicIPAddresses/delete"
                ):
                    report = Check_Report_Azure(
                        metadata=self.metadata(), resource=alert_rule
                    )
                    report.subscription = subscription_id
                    report.status = "PASS"
                    report.status_extended = f"There is an alert configured for deleting public IP address rule in subscription {subscription_name} ({subscription_id})."
                    break
            else:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status = "FAIL"
                report.status_extended = f"There is not an alert for deleting public IP address rule in subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References