Advanced

Azure Monitor & Activity Log Alerts

Even with RBAC, locks, and policies in place, monitoring is essential. Activity Log alerts detect delete attempts in real time, KQL queries track agent behavior patterns, and dashboards provide visibility into your guardrail effectiveness.

The Alert Pipeline

Azure's monitoring pipeline for AI agent activity flows through several stages:

  1. Activity Log Captures the Event

    Every ARM operation (including failed attempts blocked by RBAC or Policy) is recorded in the Azure Activity Log. This includes the caller identity, operation name, resource ID, status, and timestamp.

  2. Alert Rule Evaluates the Event

    Activity Log alert rules match events based on criteria like operation name (e.g., Microsoft.Resources/subscriptions/resourceGroups/delete), status (succeeded or failed), and caller identity.

  3. Action Group Sends Notifications

    When an alert fires, the associated action group dispatches notifications via email, SMS, webhook (Slack/Teams), Azure Function, Logic App, or ITSM connector.

  4. Team Responds to the Alert

    The operations team receives the notification and follows the incident response playbook - assess damage, disable the agent if needed, and begin recovery.

Creating Activity Log Alerts for Delete Operations

Creating an action group for notifications
# Create an action group with email and webhook (Slack/Teams)
az monitor action-group create \
  --resource-group rg-monitoring \
  --name "ag-agent-alerts" \
  --short-name "AgentAlert" \
  --action email ops-team ops-team@company.com \
  --action email security-team security@company.com \
  --action webhook slack-webhook "https://hooks.slack.com/services/T00/B00/xxxxx"
Creating Activity Log alerts for destructive operations
# Alert on resource group deletions
az monitor activity-log alert create \
  --resource-group rg-monitoring \
  --name "alert-rg-delete" \
  --description "Alerts when any resource group is deleted" \
  --condition category=Administrative \
    and operationName=Microsoft.Resources/subscriptions/resourceGroups/delete \
  --action-group ag-agent-alerts \
  --scope /subscriptions/YOUR-SUBSCRIPTION-ID

# Alert on VM deletions
az monitor activity-log alert create \
  --resource-group rg-monitoring \
  --name "alert-vm-delete" \
  --description "Alerts when any VM is deleted" \
  --condition category=Administrative \
    and operationName=Microsoft.Compute/virtualMachines/delete \
    and status=Succeeded \
  --action-group ag-agent-alerts \
  --scope /subscriptions/YOUR-SUBSCRIPTION-ID

# Alert on storage account deletions
az monitor activity-log alert create \
  --resource-group rg-monitoring \
  --name "alert-storage-delete" \
  --description "Alerts when a storage account is deleted" \
  --condition category=Administrative \
    and operationName=Microsoft.Storage/storageAccounts/delete \
    and status=Succeeded \
  --action-group ag-agent-alerts \
  --scope /subscriptions/YOUR-SUBSCRIPTION-ID

# Alert on SQL database deletions
az monitor activity-log alert create \
  --resource-group rg-monitoring \
  --name "alert-sql-delete" \
  --description "Alerts when a SQL database is deleted" \
  --condition category=Administrative \
    and operationName=Microsoft.Sql/servers/databases/delete \
    and status=Succeeded \
  --action-group ag-agent-alerts \
  --scope /subscriptions/YOUR-SUBSCRIPTION-ID
✅
Pro Tip: Create alerts for both status=Succeeded (deletion happened) and status=Failed (deletion was blocked). Failed deletions indicate the agent is attempting destructive operations, which is a signal to review its instructions or permissions.

Log Analytics and KQL Queries

For deeper analysis, send Activity Logs to a Log Analytics workspace and use Kusto Query Language (KQL) to analyze agent behavior:

Setting up diagnostic settings for Activity Log
# Create a Log Analytics workspace
az monitor log-analytics workspace create \
  --resource-group rg-monitoring \
  --workspace-name law-agent-monitoring \
  --location eastus

# Send Activity Logs to Log Analytics
az monitor diagnostic-settings subscription create \
  --name "send-activity-to-law" \
  --subscription YOUR-SUBSCRIPTION-ID \
  --workspace /subscriptions/SUB-ID/resourceGroups/rg-monitoring/providers/Microsoft.OperationalInsights/workspaces/law-agent-monitoring \
  --logs '[{"category": "Administrative", "enabled": true}, {"category": "Security", "enabled": true}, {"category": "Policy", "enabled": true}]'

KQL Queries for Detecting Destructive Operations

KQL: All delete operations in the last 24 hours
AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue endswith "delete"
| project
    TimeGenerated,
    Caller,
    CallerIpAddress,
    OperationNameValue,
    ResourceGroup,
    _ResourceId,
    ActivityStatusValue,
    ActivitySubstatusValue
| order by TimeGenerated desc
KQL: Delete operations by AI agent identities
// Track all operations by AI agent managed identities
let agentPrincipals = dynamic([
    "ai-agent-identity-principal-id-1",
    "ai-agent-identity-principal-id-2"
]);
AzureActivity
| where TimeGenerated > ago(7d)
| where Authorization_d has_any (agentPrincipals) or Caller has_any (agentPrincipals)
| where OperationNameValue endswith "delete"
    or OperationNameValue has "deallocate"
    or OperationNameValue has "powerOff"
| summarize
    TotalAttempts = count(),
    SuccessfulDeletes = countif(ActivityStatusValue == "Success"),
    BlockedDeletes = countif(ActivityStatusValue == "Failed")
    by Caller, OperationNameValue
| order by TotalAttempts desc
KQL: Anomaly detection for unusual delete patterns
// Detect unusual spikes in delete operations
AzureActivity
| where TimeGenerated > ago(30d)
| where OperationNameValue endswith "delete"
| summarize DeleteCount = count() by bin(TimeGenerated, 1h), Caller
| evaluate series_decompose_anomalies(DeleteCount, 3)
| where DeleteCount_ad_flag == 1
| project TimeGenerated, Caller, DeleteCount, DeleteCount_ad_score
| order by DeleteCount_ad_score desc
KQL: Policy deny events caused by AI agent operations
// Find operations blocked by Azure Policy
AzureActivity
| where TimeGenerated > ago(24h)
| where ActivityStatusValue == "Failed"
| where ActivitySubstatusValue == "Forbidden"
    or Properties_d has "RequestDisallowedByPolicy"
| project
    TimeGenerated,
    Caller,
    OperationNameValue,
    ResourceGroup,
    _ResourceId,
    Properties = Properties_d
| order by TimeGenerated desc

Microsoft Defender for Cloud Alerts

Microsoft Defender for Cloud provides additional security alerts that complement Activity Log monitoring:

Alert Type What It Detects Relevance to AI Agents
Suspicious resource deletion Mass deletion of resources in a short time Detects agent running batch delete commands
Unusual access pattern Access from new locations or unusual times Detects compromised agent credentials
Privilege escalation Attempts to grant elevated permissions Detects agent trying to modify its own permissions
Suspicious management operation Rare or unusual ARM operations Detects agent performing operations outside normal patterns

Building Azure Monitor Dashboards

Azure CLI: Creating a shared dashboard (dashboard.json template)
{
  "properties": {
    "lenses": {
      "0": {
        "parts": {
          "0": {
            "position": { "x": 0, "y": 0, "colSpan": 6, "rowSpan": 4 },
            "metadata": {
              "type": "Extension/Microsoft_OperationsManagementSuite_Workspace/PartType/LogsDashboardPart",
              "settings": {
                "content": {
                  "Query": "AzureActivity | where OperationNameValue endswith 'delete' | summarize count() by bin(TimeGenerated, 1h) | render timechart",
                  "ControlType": "FrameControlChart"
                }
              }
            }
          },
          "1": {
            "position": { "x": 6, "y": 0, "colSpan": 6, "rowSpan": 4 },
            "metadata": {
              "type": "Extension/Microsoft_OperationsManagementSuite_Workspace/PartType/LogsDashboardPart",
              "settings": {
                "content": {
                  "Query": "AzureActivity | where OperationNameValue endswith 'delete' | summarize count() by Caller | top 10 by count_ | render piechart",
                  "ControlType": "FrameControlChart"
                }
              }
            }
          }
        }
      }
    }
  }
}
💡
Dashboard Best Practices: Create a dedicated "AI Agent Activity" dashboard that shows: (1) Delete operations over time (trend chart), (2) Top callers performing deletes (pie chart), (3) Policy deny events (bar chart), (4) Failed vs successful delete attempts (comparison), and (5) Resources most frequently targeted by delete operations.

Ready to Go Deeper?

Live instructor-led courses from our partners. Affiliate disclosure.

🧠

AI & ML Courses - 30% Off

Live instructor-led AI, machine learning, data science, and cloud courses for working professionals. Use code Limited30 at checkout.

Edureka
📊

DataCamp - AI & Data Science

Hands-on Python, machine learning, and AI courses with interactive exercises and real projects.

DataCamp
🎓

edX - Top AI Courses

University-level AI courses from MIT, Harvard, Stanford. Earn certificates that employers recognize.

edX