How to get alert on mail when any new Azure service gets created by someone?

%3CLINGO-SUB%20id%3D%22lingo-sub-2071861%22%20slang%3D%22en-US%22%3EHow%20to%20get%20alert%20on%20mail%20when%20any%20new%20Azure%20service%20gets%20created%20by%20someone%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2071861%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20want%20to%20setup%20a%20mail%20at%20particular%20time%20in%20a%20day%20and%20it%20should%20collect%20all%20the%20Azure%20services%20which%20got%20created%20by%20someone%20in%20past%2024%20hours.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20can%20we%20achieve%20this%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2074241%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20get%20alert%20on%20mail%20when%20any%20new%20Azure%20service%20gets%20created%20by%20someone%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2074241%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F922067%22%20target%3D%22_blank%22%3E%40mehtaparth09%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20best%20way%20to%20achieve%20your%20goal%20is%20by%20leveraging%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Factivity-log-alerts%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3EAzure%20Activity%20Log%20alerts%3C%2FA%3E.%20See%20more%20details%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Falerts-activity-log%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Ehere%3C%2FA%3E%20about%20how%20to%20create%20an%20Activity%20Log%20alert.%20If%20this%20solution%20does%20not%20meet%20your%20requirements%2C%20you%20also%20have%20the%20option%20of%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fazure-monitor%2Fplatform%2Factivity-log%23send-to-log-analytics-workspace%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3Eexporting%20the%20Activity%20Log%20to%20Log%20Analytics%3C%2FA%3E%20and%20then%20build%20your%20reporting%20needs%20on%20top%20of%20it.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2074568%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20get%20alert%20on%20mail%20when%20any%20new%20Azure%20service%20gets%20created%20by%20someone%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2074568%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20this%20is%20what%20i've%20tested%20and%20it's%20working%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECreate%20an%20alerte%20rule%26nbsp%3B%3C%2FP%3E%3CP%3EScope%20%3A%20Select%20your%20subscription%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3ECondition%20%3A%20Search%20for%20signal%20logic%20%3A%26nbsp%3B%26nbsp%3BCreate%20Deployment%20(Microsoft.Resources%2Fdeployments)%3C%2FP%3E%3CP%3EThe%20condition%20preview%20should%20be%20%3A%26nbsp%3B%20%26nbsp%3BWhenever%20the%20Activity%20Log%20has%20an%20event%20with%20Category%3D'Administrative'%2C%20Signal%20name%3D'Create%20Deployment%20(deployments)'%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECreate%20an%20action%20group%26nbsp%3B%3C%2FP%3E%3CP%3ENotification%20type%20%3A%20Select%20%3A%20Email%2FSMS%20message%20%2FPush%2FVoice%20and%20give%20your%20email%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECreate%20a%20resource%20%3A%20you%20should%20receive%20an%20email%26nbsp%3B%20like%20this%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CTABLE%20width%3D%22100%25%22%3E%3CTBODY%3E%3CTR%3E%3CTD%20width%3D%22616%22%3E%3CTABLE%20width%3D%22100%25%22%3E%3CTBODY%3E%3CTR%3E%3CTD%3E%3CTABLE%20width%3D%22100%25%22%3E%3CTBODY%3E%3CTR%3E%3CTD%20width%3D%2223%25%22%3E%3CP%3EActivity%20log%20alert%3C%2FP%3E%3C%2FTD%3E%3CTD%20width%3D%2275%25%22%3E%3CP%3ETEST%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2223%25%22%3E%3CP%3ETime%3C%2FP%3E%3C%2FTD%3E%3CTD%20width%3D%2275%25%22%3E%3CP%3EJanuary%2019%2C%202021%2019%3A20%20UTC%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2223%25%22%3E%3CP%3ECategory%3C%2FP%3E%3C%2FTD%3E%3CTD%20width%3D%2275%25%22%3E%3CP%3EAdministrative%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2223%25%22%3E%3CP%3EOperation%20name%3C%2FP%3E%3C%2FTD%3E%3CTD%20width%3D%2275%25%22%3E%3CP%3EMicrosoft.Resources%2Fdeployments%2Fwrite%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2223%25%22%3E%3CP%3ECorrelation%20ID%3C%2FP%3E%3C%2FTD%3E%3CTD%20width%3D%2275%25%22%3E%3CP%3Ed7f8e759-844b-4ee0-9d9f-c3910c0f3bdd%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2223%25%22%3E%3CP%3ELevel%3C%2FP%3E%3C%2FTD%3E%3CTD%20width%3D%2275%25%22%3E%3CP%3EInformational%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2223%25%22%3E%3CP%3EResource%20ID%3C%2FP%3E%3C%2FTD%3E%3CTD%20width%3D%2275%25%22%3E%3CP%3E%2Fsubscriptions%2FyoursubscribtionID%2FresourceGroups%2FYourResourceGroup%2Fproviders%2FMicrosoft.Resources%2Fdeployments%2FMicrosoft.StorageAccount-20210119201932%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2223%25%22%3E%3CP%3ECaller%3C%2FP%3E%3C%2FTD%3E%3CTD%20width%3D%2275%25%22%3E%3CP%3Eyour%20email%26nbsp%3B%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3CTR%3E%3CTD%20width%3D%2223%25%22%3E%3CP%3EProperties%3C%2FP%3E%3C%2FTD%3E%3CTD%20width%3D%2275%25%22%3E%3CP%3E%7B%22eventCategory%22%3A%22Administrative%22%2C%22entity%22%3A%22%2Fsubscriptions%2FYour%20subscription%20id%20%2FresourceGroups%2FYourResourceGroup%2Fproviders%2FMicrosoft.Resources%2Fdeployments%2FMicrosoft.StorageAccount-20210119201932%22%2C%22message%22%3A%22Microsoft.Resources%2Fdeployments%2Fwrite%22%2C%22hierarchy%22%3A%22Your%20subscription%20id%20%22%7D%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3C%2FTD%3E%3CTD%20width%3D%220%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi,

 

I want to setup a mail at particular time in a day and it should collect all the Azure services which got created by someone in past 24 hours.

 

How can we achieve this?

3 Replies

@mehtaparth09 

 

The best way to achieve your goal is by leveraging Azure Activity Log alerts. See more details here about how to create an Activity Log alert. If this solution does not meet your requirements, you also have the option of exporting the Activity Log to Log Analytics and then build your reporting needs on top of it.

 

 

Hi this is what i've tested and it's working 

 

Create an alerte rule 

Scope : Select your subscription  

Condition : Search for signal logic :  Create Deployment (Microsoft.Resources/deployments)

The condition preview should be :   Whenever the Activity Log has an event with Category='Administrative', Signal name='Create Deployment (deployments)'

 

Create an action group 

Notification type : Select : Email/SMS message /Push/Voice and give your email 

 

Create a resource : you should receive an email  like this 

 

Activity log alert

TEST

Time

January 19, 2021 19:20 UTC

Category

Administrative

Operation name

Microsoft.Resources/deployments/write

Correlation ID

d7f8e759-844b-4ee0-9d9f-c3910c0f3bdd

Level

Informational

Resource ID

/subscriptions/yoursubscribtionID/resourceGroups/YourResourceGroup/providers/Microsoft.Resources/deployments/Microsoft.StorageAccount-20210119201932

Caller

your email 

Properties

{"eventCategory":"Administrative","entity":"/subscriptions/Your subscription id /resourceGroups/YourResourceGroup/providers/Microsoft.Resources/deployments/Microsoft.StorageAccount-20210119201932","message":"Microsoft.Resources/deployments/write","hierarchy":"Your subscription id "}

 

 

You need to acknowledge or close the alert to avoid getting notified again

 

 

I would set up two notifications. One like the "Create Deployment" image and a notification when a new resource group is created. Should then actually cover everything (per subscription). I hope this helps you? Kind regards, Tom Wechsler

Alert_Rule.JPG

@mehtaparth09