We are trying to setup alert notification for four resource types. I believe I can use a Sample alert for Key Vault changes but the others I'm not sure how best to setup notifications:
- Resource Type: Azure Key Vault
-Security Use Case: Detect when key vaults are accessed from non-approved IPs (Microsoft owned or Customer owned, for example)
- Resource: Azure Active Directory
-Security Use Case: Configuration changes to conditional access policy
- Resource type: Azure Management Groups
-Security Use Case: Detect changes to Azure Security Policy at the Management Group level
- Resource type: Resource Lock (not so much a resource type, but a functionality on specific resources that we want to monitor)
-Security Use Case: Resource Lock changes and related activity such as deletion or modification of unlocked resources
I thought I could use a Logic app or Event Grid but I'm unable to find the correct method for setting up the above requirements I'm trying to configure. Any assistance or direction on how best to address.
Cheers,
Serge
