Skip to main content

Azure Audit Compute Alerts For Vm Create Update Events Fix

Triage and Remediation​

Remediation​

Using Console

Below are step‑by‑step instructions to set up alerts for Create or Update Virtual Machine events in Azure using the Azure Portal.

You’ll create an Activity log alert on the relevant operations for Azure VMs.

1. Go to Activity Log​

  1. Sign in to the Azure Portal: https://portal.azure.com
  2. In the left‑hand menu, select Monitor.
  3. In the Monitor pane, click Activity log.

2. Filter to the Relevant Operations (Optional but Helpful)​

This step is mainly to confirm the operation names you want to alert on.

  1. At the top of the Activity log:
    • Set Subscription to the subscription where the VMs are created/updated.
    • (Optional) Set Resource group if you want to scope it.
    • Set Timespan to something reasonable (e.g., Last 24 hours).
  2. In Event category, select Administrative.
  3. In Operation name, type or choose:
    • Create or Update Virtual Machine
    • (Depending on your portal view, this may show as Microsoft.Compute/virtualMachines/write)

You should see past events corresponding to VM create/update operations.

3. Start Creating the Activity Log Alert​

There are two common paths:

Path A – From a specific event (quick way):

  1. In the Activity log results, click on any Create or Update Virtual Machine event.
  2. In the event details pane, click New alert rule at the top.

Path B – From Monitor (more controlled/general):

  1. In Monitor (left menu), click Alerts.
  2. Click + Create > Alert rule.
  3. Under Scope, click Select resource:
    • Select the subscription (recommended) so it applies to all VMs in that subscription.
    • Click Done.

4. Define the Condition (Operation = Create/Update VM)​

  1. In the Create alert rule screen, under Condition, click Add condition.
  2. In the Signal name list, pick something like:
    • Administrative > Create or Update Virtual Machine
      or
    • Administrative > Microsoft.Compute/virtualMachines/write
      (name can vary slightly by portal view).
  3. After selecting the signal, a Configure signal logic panel opens:
    • Ensure Event level is set as desired (e.g., All, or specific levels like Information / Warning / Error).
    • You can optionally filter further by:
      • Resource group
      • Resource
      • Caller (e.g., a particular user or service principal)
    • Usually, for catch‑all alerts, leave those filters broad.
  4. Click Done (or Apply) to save the condition.

5. Configure the Action Group (Who/How to Notify)​

If you already have an action group, you can reuse it. Otherwise:

  1. Under Actions, click + Create action group (or Select action group if one exists).
  2. If creating a new one:
    • Action group name: e.g., vm-create-update-alerts-ag
    • Display name: e.g., VMCreateUpdateAG
    • Subscription and Resource group: choose where to store the action group.
    • Click Next: Notifications.
  3. Under Notifications:
    • Click + Add notification.
    • Notification type: choose e.g. Email/SMS message/Push/Voice.
    • Configure:
      • Name: e.g., EmailOpsTeam
      • Email: ops/security team distribution list.
    • Click OK.
  4. (Optional) Under Actions, you can add:
    • Logic App, Webhook, Function, etc., for automated workflows.
  5. Click Review + create, then Create to finish the action group.
  6. Back in the alert rule, make sure the newly created action group is selected.

6. Set Alert Rule Details​

  1. Under Alert rule details:
    • Alert rule name: e.g., Alert - Create or Update Virtual Machine
    • Description: e.g., Triggers when any VM is created or updated in this subscription.
    • Resource group: where to store the alert rule (often a shared monitoring RG).
    • Enable alert rule upon creation: On.
  2. Review all settings (Scope, Condition, Action Group, Details).

7. Create the Alert Rule​

  1. Click Review + create.
  2. Click Create.
  3. Wait a few seconds for deployment to complete.

8. Validate the Alert​

  1. Create or update a test VM:
    • For example, change the size or tags of a VM, or create a new one.
  2. After the operation completes, wait a few minutes.
  3. Confirm:
    • You receive the notification (email/SMS/etc.).
    • In Monitor > Alerts, you see a new Fired alert with your rule name.

These steps will ensure that any Create or Update Virtual Machine (Azure Compute) operation in the selected scope triggers an alert via your chosen notification channels.

Using CLI

Below is how to set up an Azure Activity Log alert (via Azure CLI) that fires whenever a Virtual Machine is created or updated (Microsoft.Compute/virtualMachines/write).

Assumptions:

  • You have az CLI installed and are logged in (az login).
  • You know the subscription ID and resource group where you want the alert resource to live.
  • You know where to send the alert (e.g., an existing Action Group).

1. Set variables​

SUBSCRIPTION_ID="<your-subscription-id>"
RESOURCE_GROUP="<alert-resource-group-name>"   # RG where the alert and action group exist/will exist
LOCATION="eastus"                              # or any region that supports Monitor
ALERT_NAME="VM-Create-Update-Alert"
ACTION_GROUP_NAME="vm-alerts-ag"
ACTION_GROUP_SHORT_NAME="vmalerts"
EMAIL_ADDRESS="<your-email@example.com>"

2. Make sure you’re using the right subscription​

az account set --subscription "$SUBSCRIPTION_ID"

3. Create an Action Group (if you don’t have one)​

az monitor action-group create \
  --resource-group "$RESOURCE_GROUP" \
  --name "$ACTION_GROUP_NAME" \
  --short-name "$ACTION_GROUP_SHORT_NAME" \
  --action email Admin "$EMAIL_ADDRESS"

Note: You can add SMS, webhook, etc. as needed.

4. Get the Action Group Resource ID​

ACTION_GROUP_ID=$(az monitor action-group show \
  --resource-group "$RESOURCE_GROUP" \
  --name "$ACTION_GROUP_NAME" \
  --query "id" -o tsv)

5. Create the Activity Log Alert for VM Create/Update​

The key is the operation name equals Microsoft.Compute/virtualMachines/write.

az monitor activity-log alert create \
  --name "$ALERT_NAME" \
  --resource-group "$RESOURCE_GROUP" \
  --scopes "/subscriptions/$SUBSCRIPTION_ID" \
  --condition "category=Administrative and operationName=Microsoft.Compute/virtualMachines/write" \
  --action-group "$ACTION_GROUP_ID" \
  --location "$LOCATION" \
  --description "Alert when a Virtual Machine is created or updated"

6. (Optional) Add filters (e.g. for specific resource groups)​

If you only want alerts for a specific VM resource group:

VM_RG_NAME="<vm-resource-group>"

az monitor activity-log alert update \
  --name "$ALERT_NAME" \
  --resource-group "$RESOURCE_GROUP" \
  --add condition.allOf "field=resourceGroupName and equals=$VM_RG_NAME"

Once this is done, any Create or Update VM operation (Microsoft.Compute/virtualMachines/write) in the scope you defined will trigger the alert and send notifications via the Action Group.

Using Python

Below is one way to remediate this in Azure: create an Activity Log Alert that fires whenever a Create or Update Virtual Machine operation occurs, using Python and the Azure SDK.

1. Prerequisites​

  1. Install packages:
pip install azure-identity azure-mgmt-monitor

  1. Make sure you have:

    • SUBSCRIPTION_ID where VMs are created.
    • A resource group for the alert rule.
    • A notification action (e.g., an existing Action Group resource ID) or at least a placeholder if you only want the alert created first.

  2. Authenticate:

    • Use az login locally, or
    • Managed Identity / Service Principal with Monitoring Contributor (or higher) on the subscription.

2. Map the Event You Want to Alert On​

  • Category: Administrative
  • Operation name for VM create/update:
    Microsoft.Compute/virtualMachines/write

You’ll build an activity log alert that watches that operation.

3. Python Code to Create/Update the Activity Log Alert​

from azure.identity import DefaultAzureCredential
from azure.mgmt.monitor import MonitorManagementClient
from azure.mgmt.monitor.models import (
    ActivityLogAlertResource,
    ActivityLogAlertAllOfCondition,
    ActivityLogAlertLeafCondition,
    ActivityLogAlertActionList,
    ActivityLogAlertActionGroup
)

# -----------------------------------------------------------------------------
# CONFIGURATION
# -----------------------------------------------------------------------------
SUBSCRIPTION_ID = "<your-subscription-id>"
RESOURCE_GROUP  = "<your-resource-group-name>"
ALERT_RULE_NAME = "vm-create-update-alert"
LOCATION        = "global"   # required for Activity Log alerts; typically 'global'

# Optional: Action Group Resource ID (for email/SMS/webhook/etc.)
ACTION_GROUP_RESOURCE_ID = (
    "/subscriptions/<sub-id>/resourceGroups/<rg-name>/providers/"
    "microsoft.insights/actionGroups/<action-group-name>"
)

credential = DefaultAzureCredential()
monitor_client = MonitorManagementClient(credential, SUBSCRIPTION_ID)

# -----------------------------------------------------------------------------
# DEFINE ALERT CONDITIONS
# -----------------------------------------------------------------------------

# Condition: Category == 'Administrative'
category_condition = ActivityLogAlertLeafCondition(
    field="category",
    equals="Administrative"
)

# Condition: OperationName == 'Microsoft.Compute/virtualMachines/write'
operation_condition = ActivityLogAlertLeafCondition(
    field="operationName",
    equals="Microsoft.Compute/virtualMachines/write"
)

# Combine with AND (AllOfCondition)
all_of_condition = ActivityLogAlertAllOfCondition(
    all_of=[
        category_condition,
        operation_condition
    ]
)

# Scope: typically the subscription, can be resource group or specific VM
scope = f"/subscriptions/{SUBSCRIPTION_ID}"

# -----------------------------------------------------------------------------
# DEFINE ACTIONS (what happens when alert fires)
# -----------------------------------------------------------------------------
actions = ActivityLogAlertActionList(
    action_groups=[
        ActivityLogAlertActionGroup(
            action_group_id=ACTION_GROUP_RESOURCE_ID,
            webhook_properties={}   # optional key/value metadata
        )
    ]
)

# -----------------------------------------------------------------------------
# BUILD ALERT RESOURCE
# -----------------------------------------------------------------------------
alert_resource = ActivityLogAlertResource(
    location=LOCATION,
    scopes=[scope],
    condition=all_of_condition,
    actions=actions,
    enabled=True,
    description="Alert on Create/Update VM operations (Microsoft.Compute/virtualMachines/write).",
    tags={}
)

# -----------------------------------------------------------------------------
# CREATE OR UPDATE ALERT
# -----------------------------------------------------------------------------
alert = monitor_client.activity_log_alerts.create_or_update(
    resource_group_name=RESOURCE_GROUP,
    activity_log_alert_name=ALERT_RULE_NAME,
    activity_log_alert=alert_resource
)

print(f"Created/updated Activity Log Alert: {alert.id}")

4. Verification​

  1. In the Azure Portal:
    • Go to Monitor → Alerts → Alert rules.
    • Confirm your rule vm-create-update-alert exists and is enabled.
  2. Trigger a VM create or update:
    • Create a test VM or change its size.
  3. Check:
    • The alert rule’s fires.
    • Action Group notifications are received (email/SMS/webhook, etc.).

If you tell me your exact notification method (email, webhook, Teams, etc.), I can adjust the action group / code accordingly.

Using Terraform
resource "azurerm_monitor_action_group" "VM_ALERT_ACTION_GROUP" {
  name                = "vm-create-update-alert-action-group"
  resource_group_name = "RESOURCE_GROUP_NAME"   # replace with your RG for the action group
  short_name          = "vm-alert"

  email_receiver {
    name          = "primary-email"
    email_address = "ALERT_EMAIL_ADDRESS"       # replace with your alert destination email
  }
}

resource "azurerm_monitor_activity_log_alert" "VM_CREATE_UPDATE_ALERT" {
  name                = "vm-create-update-activity-log-alert"
  resource_group_name = "RESOURCE_GROUP_NAME"          # replace with your RG for the alert
  scopes              = ["/subscriptions/SUBSCRIPTION_ID"]  # replace with your subscription ID
  description         = "Alert on create or update of Azure virtual machines"

  criteria {
    category       = "Administrative"
    operation_name = "Microsoft.Compute/virtualMachines/write"
    level          = "Informational"
  }

  action {
    action_group_id = azurerm_monitor_action_group.VM_ALERT_ACTION_GROUP.id
  }

  tags = {
    environment = "ENVIRONMENT_TAG"            # replace or remove as needed
  }
}

This adds an Activity Log alert that fires whenever a VM is created or updated (the Microsoft.Compute/virtualMachines/write operation) and sends notifications via the configured action group; it does not force replacement of any existing VM resources.

To verify, terraform plan should show creation of a new azurerm_monitor_activity_log_alert.VM_CREATE_UPDATE_ALERT (and azurerm_monitor_action_group.VM_ALERT_ACTION_GROUP if new) with the criteria operation_name = "Microsoft.Compute/virtualMachines/write".