Check ID: monitor_alert_delete_security_solution
Provider: Azure
Service: monitor
Severity: MEDIUM
Categories: logging
Resource type: microsoft.insights/activitylogalerts

What this check verifies

Azure activity log alerts monitor deletions of Security Solutions by targeting the operation Microsoft.Security/securitySolutions/delete at subscription scope. Identifies whether notifications are configured for security solution removal events.

Risk

Without this alert, unauthorized or accidental deletions of security tooling may go unnoticed, reducing the availability of protections and the integrity of monitoring. Adversaries can evade defenses, prolong dwell time, and enable data exfiltration under reduced visibility.

Recommendation

Configure a dedicated activity log alert for Microsoft.Security/securitySolutions/delete and route it to resilient action groups (email, chat, ticketing, SIEM). Apply least privilege and resource locks to deter tampering. Test alerting routinely and integrate it into defense-in-depth monitoring.

Remediation

az monitor activity-log alert create -g <example_resource_name> -n <example_resource_name> --condition operationName=Microsoft.Security/securitySolutions/delete --scope /subscriptions/<example_resource_id>

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_alert_delete_security_solution. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks