Skip to main content

Description

Create an activity log alert for the Create Policy Assignment event.

Rationale​

Monitoring for create policy assignment events gives insight into changes done in "Azure policy - assignments" and can reduce the time it takes to detect unsolicited changes.

Audit​

From Azure Portal​

  1. Navigate to the Monitor blade.
  2. Click on Alerts.
  3. In the Alerts window, click on Alert rules.
  4. Ensure an alert rule exists where the Condition column contains Operation name=Microsoft.Authorization/policyAssignments/write.
  5. Click on the Alert Name associated with the previous step.
  6. Ensure the Condition panel displays the textWhenever the Activity Log has an event with Category='Administrative', Operation name='Create policy assignment' and does not filter on Level, Status or Caller.
  7. Ensure the Actions panel displays an Action group is assigned to notify the appropriate personnel in your organization.

From Azure CLI​

az monitor activity-log alert list --subscription <subscription ID> --query "[].{Name:name,Enabled:enabled,check:condition.allOf,Actions:actions}"

Look for Microsoft.Authorization/policyAssignments/write in the output. If it's missing, generate a finding.

From PowerShell​

Get-AzActivityLogAlert -SubscriptionId <subscription ID>|where-object {$_.ConditionAllOf.Equal -match "Microsoft.Authorization/policyAssignments/write"}|select-object Location,Name,Enabled,ResourceGroupName,ConditionAllOf

If the output is empty, an alert rule for Create Policy Assignments is not configured.

From Azure Policy​

If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.

Default Value​

By default, no monitoring alerts are created.

References​

  1. https://azure.microsoft.com/en-us/updates/classic-alerting-monitoring-retirement
  2. https://docs.microsoft.com/en-in/azure/azure-monitor/platform/alerts-activity-log
  3. https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/createorupdate
  4. https://docs.microsoft.com/en-in/rest/api/monitor/activitylogalerts/listbysubscriptionid
  5. https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-logging-threat-detection#lt-3-enable-logging-for-security-investigation
  6. https://docs.microsoft.com/en-in/rest/api/policy/policy-assignments
  7. https://docs.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log