Back to Checks
azure

Azure subscription has an enabled Activity Log alert for Service Health incidents

monitor_alert_service_health_exists
Service: monitorSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:microsoft.insights/activitylogalerts

Azure Monitor Activity Log alert is configured for Service Health notifications where category is ServiceHealth and properties.incidentType is Incident, with the rule enabled.

Prowler logoProwlerprowler-provider-azure

Risk

Without alerts for Service Health incidents, teams may miss Azure outages or degradations, harming availability and delaying failover. Unseen incidents can cause cascading errors, timeouts, deployment failures, and SLA breaches across dependent workloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks monitor_alert_service_health_exists

Recommendation

Create and maintain an enabled Activity Log alert for Service Health Incident events.

  • Route via Action Groups to on-call channels
  • Filter to critical services/regions
  • Test routing and refine recipients regularly
  • Integrate with incident response and defense-in-depth monitoring

Remediation

CLI

az monitor activity-log alert create --resource-group <resource-group> --name <alert-rule> --scopes /subscriptions/<subscription-id> --condition "category=ServiceHealth and properties.incidentType=Incident"

Terraform

# Activity Log Alert for Service Health Incidents
resource "azurerm_monitor_activity_log_alert" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  scopes              = ["/subscriptions/<example_subscription_id>"]

  criteria {
    category = "ServiceHealth"                           # Critical: Service Health category
    service_health {
      events = ["Incident"]                              # Critical: alert only on Incident type
    }
  }
}

NativeIaC

// Activity Log Alert for Service Health Incidents
resource alert 'Microsoft.Insights/activityLogAlerts@2020-10-01' = {
  name: '<example_resource_name>'
  location: 'Global'
  properties: {
    enabled: true
    scopes: [ subscription().id ]
    condition: {
      allOf: [
        { field: 'category', equals: 'ServiceHealth' }           // Critical: match Service Health category
        { field: 'properties.incidentType', equals: 'Incident' } // Critical: alert only on Incident events
      ]
    }
  }
}

Other

1In the Azure portal, go to Service Health > Health alerts > Create service health alert
2Scope: select your Subscription and choose the Resource group to save the alert
3Event types: select only Service issues (Incidents)
4Leave other filters as default, ensure Enable rule is On, then click Create

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.monitor.monitor_client import monitor_client


class monitor_alert_service_health_exists(Check):
    def execute(self) -> list[Check_Report_Azure]:
        findings = []

        for (
            subscription_id,
            activity_log_alerts,
        ) in monitor_client.alert_rules.items():
            subscription_name = monitor_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for alert_rule in activity_log_alerts:
                # Check if alert rule is enabled and has required Service Health conditions
                if alert_rule.enabled:
                    has_service_health_category = False
                    has_incident_type_incident = False
                    for element in alert_rule.condition.all_of:
                        if (
                            element.field == "category"
                            and element.equals == "ServiceHealth"
                        ):
                            has_service_health_category = True
                        if (
                            element.field == "properties.incidentType"
                            and element.equals == "Incident"
                        ):
                            has_incident_type_incident = True

                    if has_service_health_category and has_incident_type_incident:
                        report = Check_Report_Azure(
                            metadata=self.metadata(), resource=alert_rule
                        )
                        report.subscription = subscription_id
                        report.status = "PASS"
                        report.status_extended = f"There is an activity log alert for Service Health in subscription {subscription_name} ({subscription_id})."
                        break
            else:
                report = Check_Report_Azure(metadata=self.metadata(), resource={})
                report.subscription = subscription_id
                report.resource_name = subscription_id
                report.resource_id = f"/subscriptions/{subscription_id}"
                report.status = "FAIL"
                report.status_extended = f"There is no activity log alert for Service Health in subscription {subscription_name} ({subscription_id})."

            findings.append(report)

        return findings

References