Check ID: monitor_alert_create_update_public_ip_address_rule
Provider: Azure
Service: monitor
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: microsoft.insights/activitylogalerts

What this check verifies

Azure Monitor activity log alert for Public IP addresses tracks Microsoft.Network/publicIPAddresses/write events at the subscription level, covering any creation or update of public IP resources.

Risk

Without this alert, unauthorized or mistaken public IP changes can go unnoticed, exposing workloads to the Internet.
  • Confidentiality: unexpected ingress paths
  • Integrity: shadow endpoints for control
  • Availability: larger DDoS surface and outages

Recommendation

Create a subscription-wide activity log alert on Microsoft.Network/publicIPAddresses/write and route it to an action group. Enforce least privilege for IP management, apply change control, and use defense in depth (private endpoints, bastions, VPN) to minimize public exposure and speed response.

Remediation

az monitor activity-log alert create --resource-group <example_resource_name> --name <example_resource_name> --scopes /subscriptions/<example_resource_id> --condition "category=Administrative and operationName=Microsoft.Network/publicIPAddresses/write" --location global

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_alert_create_update_public_ip_address_rule. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks