1. Login to Azure portal (https://portal.azure.com/).
2. Navigate to the SQL server for which you want to create the activity log alert.
3. Under the Security section, click on “Firewalls and virtual networks”.
4. Click on the “Activity Log Alerts” tab.
5. Click on the “Add Activity Log Alert” button.
6. In the “Create Activity Log Alert” window, provide the following details: a. Name: Provide a name for the alert. b. Description: Provide a description for the alert. c. Subscription: Select the subscription in which you want to create the alert. d. Resource Group: Select the resource group in which the SQL server is located. e. Resource Type: Select “Microsoft.Sql/servers/firewallRules” from the dropdown. f. Resource Name: Select the name of the SQL server for which you want to create the alert. g. Alert criteria: Under the “Alert criteria” section, select “Delete” from the “Operation Name” dropdown.
7. Under the “Actions” section, select the action you want to perform when the alert is triggered. You can choose to send an email or a webhook notification.
8. Click on the “Create Alert” button to create the activity log alert.

​

1. Install the Azure SDK for Python using the following command:
   pip install azure-mgmt-monitor
   
2. Import the necessary modules in your Python script:
   from azure.common.credentials import ServicePrincipalCredentials
   from azure.mgmt.monitor import MonitorManagementClient
   from azure.mgmt.monitor.models import AlertRuleResource, RuleCondition, \
                                           RuleDataSource, RuleMetricDataSource, \
                                           ThresholdRuleCondition
   from azure.mgmt.resource import ResourceManagementClient
   
3. Create a Service Principal and assign the required role to it. You can follow the instructions mentioned in this link to create a Service Principal.
4. Authenticate using the Service Principal credentials:
   credentials = ServicePrincipalCredentials(
        client_id='<your-client-id>',
        secret='<your-client-secret>',
        tenant='<your-tenant-id>'
    )
   
5. Create a Resource Management client object to get the resource group and SQL Server details:
   resource_client = ResourceManagementClient(credentials, subscription_id)
   resource_group = '<your-resource-group>'
   server_name = '<your-sql-server-name>'
   
6. Create a Monitor Management client object to create the Activity Log alert:
   monitor_client = MonitorManagementClient(credentials, subscription_id)
   
7. Create a data source for the alert:
   data_source = RuleDataSource(
        resource_uri=f"/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.Sql/servers/{server_name}/firewallRules",
        resource_provider_name="Microsoft.Sql",
        resource_type="firewallRules"
    )
   
8. Create a metric data source for the alert:
   metric_data_source = RuleMetricDataSource(
        metric_name="DeleteFirewallRule",
        resource_uri=f"/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.Sql/servers/{server_name}/firewallRules",
        resource_provider_name="Microsoft.Sql",
        resource_type="firewallRules",
        time_grain="PT1M"
    )
   
9. Create a condition for the alert:
   condition = ThresholdRuleCondition(
        metric_data=metric_data_source,
        threshold=1,
        operator="GreaterThan",
        time_aggregation="Total",
        time_window="PT5M"
    )
   
10. Create the Activity Log alert:

alert_rule_resource = AlertRuleResource(
     name="<your-alert-rule-name>",
     description="<your-alert-rule-description>",
     is_enabled=True,
     condition=condition,
     data_source=data_source
 )

alert_rule = monitor_client.alert_rules.create_or_update(
     resource_group,
     "<your-alert-rule-name>",
     alert_rule_resource
 )

11. Verify that the alert has been created successfully by checking the Azure portal.