How to create an alert for azure storage account if there is data action permissions assigned to a custom role or a built in role

Question

I want to create an alert using a Kusto query when a custom role is assigned data action permissions for azure storage account or a current role is modified with the data action permissions for the azure storage account

Answer 1

Thanks for posting your question in the Microsoft Q&A forum.

Here's an example query that demonstrates how to achieve this:

AzureActivity
| where ResourceProvider == "MICROSOFT.STORAGE"
| where Resource == "<YourStorageAccountName>"
| where OperationName == "Microsoft.Authorization/roleAssignments/write"

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful