Check ID: monitor_alert_delete_nsg
Provider: Azure
Service: monitor
Severity: HIGH
Categories: logging, forensics-ready
Resource type: microsoft.insights/activitylogalerts

What this check verifies

Azure Monitor activity log alerts include the NSG deletion signal (Microsoft.Network/networkSecurityGroups/delete or Microsoft.ClassicNetwork/networkSecurityGroups/delete). The finding indicates whether a subscription has an alert rule configured to trigger when a Network Security Group is deleted.

Risk

Without alerting on NSG deletions, network segmentation can be removed unnoticed, exposing services to broad ingress/egress. Malicious actors or automation may delete NSGs to enable lateral movement and data exfiltration. Missing alerts delay response, impacting confidentiality and availability.

Recommendation

Configure a subscription-wide activity log alert for the NSG delete operation (Microsoft.Network/networkSecurityGroups/delete; include Classic if applicable) and route notifications via action groups. Enforce least privilege for NSG changes, require change control, and integrate with your SIEM for correlation.

Remediation

az monitor activity-log alert create --name "<activity log rule name>" --resource-group "<resource group name>" --scopes "/subscriptions/<subscription ID>" --condition "category=Administrative and operationName=Microsoft.Network/networkSecurityGroups/delete" --location global

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_alert_delete_nsg. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks