Get alerted when delete lock on resource group is removed

Question

We want to get alerted

1. when delete lock on resource group is removed.
2. when delete lock on the Azure storage account is removed How to configure alert in azure monitoring for this ?

Answer 1

Hello @MS Techie

There are a few ways of doing this, either using Activity log alerts or Log Alerts if your Activity logs are sent to a Log Analytics workspace.

Here in my example I've added and removed a lock from a resource.

Using the data generated, it is easy to see the Operation names, that we are interested in and we can follow the steps here to create the activity log alert https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-new-alert-rule?tabs=metric#create-an-activity-log-alert-rule-from-the-activity-log-pane

If the Activity logs are being sent to a Log Analytics workspace, you can run a simple query to find all the "Delete management locks" events

AzureActivity
| where OperationNameValue == "MICROSOFT.AUTHORIZATION/LOCKS/DELETE"

If you want to create an Azure Monitor alert, then you can follow the steps here https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-new-alert-rule?tabs=metric#create-a-new-alert-rule-in-the-azure-portal though if you are using Microsoft Sentinel, for this type of event you may want to alert on it in that product, therefore the steps are found here https://learn.microsoft.com/en-us/azure/sentinel/detect-threats-custom

Finally it is worth noting that a lock applied to a resource group will apply to resource within that resource group, but the logs will not tell you the details about the resource within the resource group. Therefore depending on how you have applied your locks and scope the alerting, will determine if you get an alert for the storage account or for the parent resource group.

If you want to alert specifically for a storage account, then apply the lock to the storage account and make sure your activity or log alert is scoped to the subscription, resource group if you want the alert to scale / cover multiple resources at once, or just to the storage account if you want it to be specific.

I hope this helps provide you with the information you need. If it does, please make sure to mark the question as answered so it helps other people in future.

Kind regards

Alistair

Answer 2

Hello all;

I've just do it and write a very simple post on it on my blog, it can complete this answers with a sample:
https://blog.smartcloudarchitect.fr/azure-alert-lock

Answer 3

Hello all;

I've just do it and write a very simple post on it on my blog, it can complete this answers with a sample:

https://blog.smartcloudarchitect.fr/azure-alert-lock

Have a good day ;

Antoine LOIZEAU