Check ID: monitor_alert_service_health_exists
Provider: Azure
Service: monitor
Severity: MEDIUM
Categories: resilience
Resource type: microsoft.insights/activitylogalerts

What this check verifies

Azure Monitor Activity Log alert is configured for Service Health notifications where category is ServiceHealth and properties.incidentType is Incident, with the rule enabled.

Risk

Without alerts for Service Health incidents, teams may miss Azure outages or degradations, harming availability and delaying failover. Unseen incidents can cause cascading errors, timeouts, deployment failures, and SLA breaches across dependent workloads.

Recommendation

Create and maintain an enabled Activity Log alert for Service Health Incident events.
  • Route via Action Groups to on-call channels
  • Filter to critical services/regions
  • Test routing and refine recipients regularly
  • Integrate with incident response and defense-in-depth monitoring

Remediation

az monitor activity-log alert create --resource-group <resource-group> --name <alert-rule> --scopes /subscriptions/<subscription-id> --condition "category=ServiceHealth and properties.incidentType=Incident"

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = monitor_alert_service_health_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks