> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ensure Activity Log Alert exists for Delete Policy Assignment ### More Info: Monitoring for Delete policy assignment events gives insight into changes done in 'azure policy - assignments' and may reduce the time it takes to detect unsolicited changes. ### Risk Level Low ### Address Security, Operational Maturity ### Compliance Standards CISAZURE, CBP ### Triage and Remediation ### Remediation To remediate the misconfiguration "Ensure Activity Log Alert exists for Delete Policy Assignment" in Azure using the Azure console, please follow the below steps: 1. Log in to the Azure portal using your credentials. 2. Navigate to the "Activity Log Alerts" page. 3. Click on the "Add" button to create a new activity log alert. 4. In the "Basics" tab, provide a name and description for the alert. 5. In the "Condition" tab, select the "Delete Policy Assignment" option from the "Event name" dropdown list. 6. In the "Actions" tab, select the action that you want to perform when the alert is triggered. For example, you can send an email notification to the concerned team. 7. In the "Review + create" tab, review the alert configuration and click on the "Create" button to create the alert. Once the activity log alert is created, it will trigger whenever a policy assignment is deleted in your Azure environment, and you will be notified via the configured action. This will help you to detect and remediate any unauthorized policy assignment deletions and ensure the security of your Azure resources. # To remediate the misconfiguration "Ensure Activity Log Alert exists for Delete Policy Assignment" in Azure using Azure CLI, you can follow the below steps: Step 1: Open the Azure CLI and login to your Azure account using the command: ``` az login ``` Step 2: Check if there is any existing activity log alert for Delete Policy Assignment using the command: ``` az monitor activity-log alert list --query '[?contains(details.operationName.displayValue, `Microsoft.Authorization/policyAssignments/delete`)]' ``` If the output of the above command is empty, it means there is no activity log alert for Delete Policy Assignment. Step 3: Create an activity log alert for Delete Policy Assignment using the command: ``` az monitor activity-log alert create --name --description --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/delete --action-groups --enabled true ``` Replace `` with a name for the alert, `` with a description for the alert, and `` with the resource ID of the action group to which the alert should send notifications. Step 4: Verify that the activity log alert for Delete Policy Assignment has been created using the command: ``` az monitor activity-log alert list --query '[?contains(details.operationName.displayValue, `Microsoft.Authorization/policyAssignments/delete`)]' ``` The output of the above command should show the newly created activity log alert. By following the above steps, you can remediate the misconfiguration "Ensure Activity Log Alert exists for Delete Policy Assignment" in Azure using Azure CLI. To remediate the misconfiguration "Ensure Activity Log Alert exists for Delete Policy Assignment" in Azure using Python, you can follow the below steps: Step 1: Login to Azure using Python SDK. ```python theme={null} from azure.identity import DefaultAzureCredential from azure.mgmt.monitor import MonitorManagementClient from azure.mgmt.resource import ResourceManagementClient credential = DefaultAzureCredential() subscription_id = '' resource_client = ResourceManagementClient(credential, subscription_id) monitor_client = MonitorManagementClient(credential, subscription_id) ``` Step 2: Check if an Activity Log Alert exists for Delete Policy Assignment. ```python theme={null} alert_name = '' alert_resource_group_name = '' alerts = monitor_client.activity_log_alerts.list_by_resource_group(resource_group_name=alert_resource_group_name) for alert in alerts: if alert_name.lower() in alert.name.lower() and alert.condition.all_of[0].field == "category" and alert.condition.all_of[0].equals == "Policy": print("Activity Log Alert exists for Delete Policy Assignment") break else: print("Activity Log Alert does not exist for Delete Policy Assignment") ``` Step 3: Create an Activity Log Alert for Delete Policy Assignment if it does not exist. ```python theme={null} if not any(alert_name.lower() in alert.name.lower() for alert in alerts): action_group_id = '' scopes = ['/subscriptions/'] condition = "category = 'Policy' and operationName.value = 'Microsoft.Authorization/policyAssignments/delete'" email_subject = 'Alert: Delete Policy Assignment' email_body = 'Delete Policy Assignment occurred in your subscription' activity_log_alert = { "name": alert_name, "description": "Activity Log Alert for Delete Policy Assignment", "enabled": True, "scopes": scopes, "condition": { "allOf": [ { "field": "category", "equals": "Policy" }, { "field": "operationName.value", "equals": "Microsoft.Authorization/policyAssignments/delete" } ] }, "actions": { "action_groups": [ { "action_group_id": action_group_id } ], "custom_emails": { "send_to_subscription_administrator": True, "custom_email_subject": email_subject, "custom_email_body": email_body } } } activity_log_alert = monitor_client.activity_log_alerts.create_or_update( resource_group_name=alert_resource_group_name, activity_log_alert_name=alert_name, parameters=activity_log_alert ) print("Activity Log Alert created for Delete Policy Assignment") ``` By following these steps, you can remediate the misconfiguration "Ensure Activity Log Alert exists for Delete Policy Assignment" in Azure using Python. ### Additional Reading: * [https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log](https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log)