Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
monitor_alert_delete_public_ip_address_ruleProvider: Azure
Service:
monitorSeverity: MEDIUM
Categories:
loggingResource type:
microsoft.insights/activitylogalertsWhat this check verifies
Azure Monitor activity log alert exists for the Delete Public IP Address operation (Microsoft.Network/publicIPAddresses/delete), capturing subscription-wide events when Public IP resources are removed.
Risk
Unmonitored deletion of Public IPs can abruptly sever ingress/egress, break DNS and allowlists, and take services offline (availability). Attackers or misconfigurations can delete IPs to cause DoS or evade controls, and delayed visibility hinders incident response and forensics.Recommendation
Implement an activity log alert forMicrosoft.Network/publicIPAddresses/delete and route it to an action group for rapid response.
- Apply least privilege and change approval for IP deletions
- Use resource locks on critical IPs
- Centralize alerts in your SIEM and define runbooks for containment
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActivityLog/delete-public-ip-alert.html#trendmicro
- https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement
- https://learn.microsoft.com/en-in/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule?tabs=activity-log
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = monitor_alert_delete_public_ip_address_rule. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks