Your Azure Monitor alert was triggered

Question

Your Azure Monitor alert was triggered

Andrew Peter Miller 15

Hello. I receive daily and/or weekly "Your Azure Monitor alert was triggered" e-mails. First an "Azure: Deactivated" and then an "Azure: Activated" e-mails. I do not have a Microsoft Azure account. Up until receiving these e-mails starting 02/26/2026 I had never heard of Microsoft Azure. Why am I receiving these Microsoft Azure < azure-noreply @ microsoft com > e-mails and how do I make them cease.

Bharath Y P 7,340 Reputation points Microsoft External Staff Moderator

2026-03-16T17:31:57.5+00:00
Hello Andrew, it looks like someone has set up an Azure Monitor alert that’s sending activation/deactivation emails to your address—even though you don’t have an Azure subscription yourself. Here’s what you can do to make them stop:

Verify the emails are genuine

Open one of the alert messages and check for a valid Microsoft header (SPF/DKIM pass, “azure-noreply@microsoft.com” domain, etc.).

Find the Subscription ID and Alert details

Every Azure Monitor alert email lists the Subscription ID, Resource Group, Resource Name and Alert Rule Name.

Jot those down so we know exactly which alert is misconfigured.

Unsubscribe or remove your email

Often there’s an “Unsubscribe” or “Manage your alert notifications” link at the bottom of the email. Use that first.

If you don’t see an unsubscribe link, you’ll need the owner of that Azure subscription to remove your address from the Action Group tied to that alert rule.

If you can’t reach the alert owner

Open a free Azure account with the same email address, sign in to the Azure portal, and navigate to Monitor > Alerts > Manage Action Groups. Remove your address from any groups.

Or contact Microsoft support and provide them the Subscription ID/Alert Rule Name so they can take your email off the notification list.

Hope that helps! Let me know if you’re stuck locating the Subscription ID or if you need more guidance on unsubscribing.

Reference docs

Alerts overview: https://docs.microsoft.com/azure/azure-monitor/platform/alerts-overview

Managing log alerts: https://docs.microsoft.com/azure/azure-monitor/alerts/alerts-log#managing-log-alerts-from-the-azure-portal
Kyle Delaney 26 Reputation points

2026-03-17T18:44:24.74+00:00

This is happening daily for me as well. It's kind of a perfect storm of faulty design on Microsoft's part. Malicious accounts can add non-Azure addresses to action groups without consent, and then we're subscribed automatically. The only way to stop this is to block Azure entirely which could also block needed Azure communications. How can we get Microsoft to take this seriously and escalate it?
Bharath Y P 7,340 Reputation points Microsoft External Staff Moderator

2026-03-18T09:45:55.2833333+00:00

Please refer the below response which other community member faced the same issue https://learn.microsoft.com/en-us/answers/questions/5811638/are-emails-for-your-azure-monitor-alert-was-trigge

2 answers

Your answer

Bharath Y P 7,340 Reputation points Microsoft External Staff Moderator

2026-03-16T17:31:57.5+00:00

Hello Andrew, it looks like someone has set up an Azure Monitor alert that’s sending activation/deactivation emails to your address—even though you don’t have an Azure subscription yourself. Here’s what you can do to make them stop:

Verify the emails are genuine

Open one of the alert messages and check for a valid Microsoft header (SPF/DKIM pass, “azure-noreply@microsoft.com” domain, etc.).

Find the Subscription ID and Alert details

Every Azure Monitor alert email lists the Subscription ID, Resource Group, Resource Name and Alert Rule Name.

Jot those down so we know exactly which alert is misconfigured.

Unsubscribe or remove your email

Often there’s an “Unsubscribe” or “Manage your alert notifications” link at the bottom of the email. Use that first.

If you don’t see an unsubscribe link, you’ll need the owner of that Azure subscription to remove your address from the Action Group tied to that alert rule.

If you can’t reach the alert owner

Open a free Azure account with the same email address, sign in to the Azure portal, and navigate to Monitor > Alerts > Manage Action Groups. Remove your address from any groups.

Or contact Microsoft support and provide them the Subscription ID/Alert Rule Name so they can take your email off the notification list.

Hope that helps! Let me know if you’re stuck locating the Subscription ID or if you need more guidance on unsubscribing.

Reference docs

Alerts overview: https://docs.microsoft.com/azure/azure-monitor/platform/alerts-overview

Managing log alerts: https://docs.microsoft.com/azure/azure-monitor/alerts/alerts-log#managing-log-alerts-from-the-azure-portal
Kyle Delaney 26 Reputation points

2026-03-17T18:44:24.74+00:00

This is happening daily for me as well. It's kind of a perfect storm of faulty design on Microsoft's part. Malicious accounts can add non-Azure addresses to action groups without consent, and then we're subscribed automatically. The only way to stop this is to block Azure entirely which could also block needed Azure communications. How can we get Microsoft to take this seriously and escalate it?
Bharath Y P 7,340 Reputation points Microsoft External Staff Moderator

2026-03-18T09:45:55.2833333+00:00

Please refer the below response which other community member faced the same issue https://learn.microsoft.com/en-us/answers/questions/5811638/are-emails-for-your-azure-monitor-alert-was-trigge

Answer 1

TP 155.3K Volunteer Moderator

Hi,

Recently (past few weeks) there have been malicious Azure Monitor Alert messages going out and there is very good chance that is what you are receiving. DO NOT call any phone number(s) in the email messages.

It appears what is happening is bad actors get access to an Azure subscription, set up Alerts with potential victim's email address (your email) set as recipient, then trigger alert. In the text of the alert they mention things like Fraud Prevention System, Windows Defender, some substantial $ amount, potentially unauthorized charge, account suspension, Fraud Resolution Hotline, etc., and their goal is for you to call a phone number.

DO NOT call any phone number in the email and DO NOT click on any links. They want you to call them so they can scam you.

Currently there isn't a good way to make them stop. You could create an email rule to move them to separate folder. I don't recommend blocking them permanently because they are from real Microsoft email address. The text of the alert is written by the scammers.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Brian Smith 0 Reputation points

2026-03-17T21:36:11.9333333+00:00

If the email is actually coming from a Microsoft system, does that mean that it is safe to click on the "unsubscribe button?"
Jan Kovarik 15 Reputation points

2026-03-18T12:32:19.51+00:00

Thanks for the warning to NOT click the Unsubscribe link. I have, instead, created a rule to send Microsoft Azure emails directly to the DELETED folder.

This is a bulky workaround because now my DELETED folder will show "unread" messages. But that's a quick eyeball scan and then a "Mark All as Read" click.

Answer 2

Hello Andrew, Thank you for posting your query on Microsoft Q&A platform..

What you’re describing closely aligns with a known scam pattern involving Azure alert emails.

In these cases, attackers first gain access to an Azure subscription and then deliberately configure alert rules to send notifications to external email addresses (such as yours). They subsequently trigger those alerts. While the emails are technically generated by Azure, the alert message content itself is authored by the attackers.

These emails typically include alarming language such as:

references to a “Fraud Prevention System” or “Windows Defender,”
warnings about large, suspicious charges,
threats of account suspension, and
a so‑called “Fraud Resolution” or “Support Hotline” phone number.

The objective is to pressure recipients into calling that number, where the scam continues.

Important guidance:

Do not call any phone number mentioned in the email.
Do not click any links included in the message.
Simply delete the email.

It’s worth noting that these messages can appear convincing because they are sent from legitimate Microsoft email infrastructure. However, Microsoft does not include phone numbers or urgent call‑to‑action language like this in genuine Azure alert notifications.

Reference: https://malwaretips.com/blogs/microsoft-azure-alert-was-triggered-scam-exposed-investigation/

If the provided information helped, kindly consider marking the answer as "Accepted" and "Upvote" it. This helps other community members who may encounter a similar issue in the future.

If you have any queries, please feel free to reach out us.

Thanks,

Brian Smith 0 Reputation points

2026-03-21T19:09:35.59+00:00

Sir, on March 16, you explicitly told us to click the unsubscribe link. That advice is still visible in this thread. You literally said to "use that first." A little consistency from Microsoft on a "known scam pattern" would be helpful. Quoted below:

Often there’s an “Unsubscribe” or “Manage your alert notifications” link at the bottom of the email. Use that first.

Share via

Your Azure Monitor alert was triggered

2 answers

Your answer