Check ID: monitor_alert_delete_policy_assignment
Provider: Azure
Service: monitor
Severity: HIGH
Categories: logging
Resource type: microsoft.insights/activitylogalerts

What this check verifies

Azure Monitor Activity log alerts for policy assignment deletions using the Microsoft.Authorization/policyAssignments/delete operation at subscription scope

Risk

Without this alert, policy assignment deletions can go unnoticed, eroding configuration integrity and enabling governance drift. Malicious or accidental changes may remove guardrails, increasing exposure and threatening confidentiality of protected resources.

Recommendation

  • Configure an activity log alert for Microsoft.Authorization/policyAssignments/delete and route to an action group.
  • Enforce least privilege and separation of duties for policy changes and require approvals.
  • Integrate alerts with your SIEM and define playbooks for rapid response.

Remediation

az monitor activity-log alert create --resource-group <example_resource_name> --name <example_resource_name> --scopes "/subscriptions/<example_resource_id>" --condition "operationName=Microsoft.Authorization/policyAssignments/delete" --location global

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_alert_delete_policy_assignment. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks