Check ID: monitor_alert_delete_public_ip_address_rule
Provider: Azure
Service: monitor
Severity: MEDIUM
Categories: logging
Resource type: microsoft.insights/activitylogalerts

What this check verifies

Azure Monitor activity log alert exists for the Delete Public IP Address operation (Microsoft.Network/publicIPAddresses/delete), capturing subscription-wide events when Public IP resources are removed.

Risk

Unmonitored deletion of Public IPs can abruptly sever ingress/egress, break DNS and allowlists, and take services offline (availability). Attackers or misconfigurations can delete IPs to cause DoS or evade controls, and delayed visibility hinders incident response and forensics.

Recommendation

Implement an activity log alert for Microsoft.Network/publicIPAddresses/delete and route it to an action group for rapid response.
  • Apply least privilege and change approval for IP deletions
  • Use resource locks on critical IPs
  • Centralize alerts in your SIEM and define runbooks for containment

Remediation

az monitor activity-log alert create --name <activity_log_rule_name> --resource-group <resource_group_name> --location global --scopes /subscriptions/<subscription_id> --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/delete

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_alert_delete_public_ip_address_rule. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks