Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
monitor_alert_create_update_public_ip_address_ruleProvider: Azure
Service:
monitorSeverity: MEDIUM
Categories:
logging, forensics-readyResource type:
microsoft.insights/activitylogalertsWhat this check verifies
Azure Monitor activity log alert for Public IP addresses tracksMicrosoft.Network/publicIPAddresses/write events at the subscription level, covering any creation or update of public IP resources.
Risk
Without this alert, unauthorized or mistaken public IP changes can go unnoticed, exposing workloads to the Internet.- Confidentiality: unexpected ingress paths
- Integrity: shadow endpoints for control
- Availability: larger DDoS surface and outages
Recommendation
Create a subscription-wide activity log alert onMicrosoft.Network/publicIPAddresses/write and route it to an action group.
Enforce least privilege for IP management, apply change control, and use defense in depth (private endpoints, bastions, VPN) to minimize public exposure and speed response.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-in/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule?tabs=activity-log
- https://trendmicro.com/cloudoneconformity/knowledge-base/azure/ActivityLog/create-or-update-public-ip-alert.html
- https://support.icompaas.com/support/solutions/articles/62000229918-ensure-that-activity-log-alert-exists-for-create-or-update-public-ip-address-rule
- https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/monitor-public-ip
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = monitor_alert_create_update_public_ip_address_rule. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks