Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
monitor_alert_service_health_existsProvider: Azure
Service:
monitorSeverity: MEDIUM
Categories:
resilienceResource type:
microsoft.insights/activitylogalertsWhat this check verifies
Azure Monitor Activity Log alert is configured for Service Health notifications wherecategory is ServiceHealth and properties.incidentType is Incident, with the rule enabled.
Risk
Without alerts for Service Health incidents, teams may miss Azure outages or degradations, harming availability and delaying failover. Unseen incidents can cause cascading errors, timeouts, deployment failures, and SLA breaches across dependent workloads.Recommendation
Create and maintain an enabled Activity Log alert for Service Health Incident events.- Route via Action Groups to on-call channels
- Filter to critical services/regions
- Test routing and refine recipients regularly
- Integrate with incident response and defense-in-depth monitoring
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
References
- https://learn.microsoft.com/en-us/azure/service-health/service-health-notifications-properties
- https://learn.microsoft.com/en-us/azure/service-health/alerts-activity-log-service-notifications-portal
- https://learn.microsoft.com/en-us/azure/service-health/overview
- https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log-schema
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/ActivityLog/service-health-alert.html
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = monitor_alert_service_health_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks