'Delete Policy Assignment' activity log alert should be configured
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Description
To enhance the detection of unsolicited changes and streamline the monitoring of modifications made in the Policy - Assignments page, it is advised to create an activity log alert specifically for the “Delete Policy Assignment” event. This alert will provide valuable insights into any deletions of policy assignments, allowing for quick detection and response to unauthorized changes.
From the console
- Navigate to the Monitor blade.
- Select Alerts > Create > Alert rule.
- Under Filter by subscription, choose a subscription.
- Under Filter by resource type, select Policy Assignment.
- Under Filter by location, select All.
- From the results, select the subscription, then click Done.
- Select the Condition tab.
- Under Signal name, click Delete Delete policy assignment (Microsoft.Authorization/policyAssignments).
- Select the Actions tab.
- To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection.
- Select the Details tab.
- Select a Resource group, provide an Alert rule name and an optional Alert
rule description.
- Click Review + create.
- Click Create.
