Blog Post

Core Infrastructure and Security Blog
5 MIN READ

Monitoring for Azure Subscription Creation

bwatts670's avatar
bwatts670
Icon for Microsoft rankMicrosoft
Dec 28, 2020
  Introduction A common ask from enterprise customers is the ability to monitor for the creation of Azure Subscriptions. This is not as easy as you might think so I wanted to walk you through a s...
Updated Dec 28, 2020
Version 2.0
BradWatts
akssingh_shs's avatar
akssingh_shs
Copper Contributor
Dec 12, 2021

Hi ,

 

The following query will assist you in determining whether your subscription is in-active or disabled.

 

Resourcecontainers
|where type=='microsoft.resources/subscriptions' 
|where properties.state != 'Enabled'
| project id, name, mgmtgroup = (properties.managementGroupAncestorsChain) , subsstate = (properties.state)
 
You can create a logic app that can be scheduled to run at a predetermined time and will notify you if any subscription status is not enabled. I believe that if a subscription has expired or is inactive, the status refelect other than "Enabled" and this should will work for you. 
 

This ARG query will assist you in listing the subscription details that are part of the "Tenant Root Group." or you can say not added to any userdefined management group .

 

Resourcecontainers
|where type=='microsoft.resources/subscriptions'
| extend mgmtgroupCount=array_length(properties.managementGroupAncestorsChain)
| where mgmtgroupCount == 1
| project id, name, mgmtgroup = (properties.managementGroupAncestorsChain)

 

Hope this helps !