Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
monitor_alert_delete_policy_assignmentProvider: Azure
Service:
monitorSeverity: HIGH
Categories:
loggingResource type:
microsoft.insights/activitylogalertsWhat this check verifies
Azure Monitor Activity log alerts for policy assignment deletions using theMicrosoft.Authorization/policyAssignments/delete operation at subscription scope
Risk
Without this alert, policy assignment deletions can go unnoticed, eroding configuration integrity and enabling governance drift. Malicious or accidental changes may remove guardrails, increasing exposure and threatening confidentiality of protected resources.Recommendation
- Configure an activity log alert for
Microsoft.Authorization/policyAssignments/deleteand route to an action group. - Enforce least privilege and separation of duties for policy changes and require approvals.
- Integrate alerts with your SIEM and define playbooks for rapid response.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-in/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule?tabs=activity-log
- https://learn.microsoft.com/en-in/rest/api/monitor/activity-log-alerts/create-or-update?view=rest-monitor-2020-10-01&tabs=HTTP
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActivityLog/delete-policy-assignment-alert-in-use.html#trendmicro
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = monitor_alert_delete_policy_assignment. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks