Azure Monitor Alert Customize actions

Question

Hello,

Earlier when creating an alert in Azure monitor, I was able to customize actions - specifically the Email Subject. Now, I don't see that option. Instead the alert emails that I get are the generic Microsoft alert emails. Please note that this is from the Azure Portal.

Has something changed? Please advise.

Answer 1

Hi @Jatin Bhatt ,

Yes, Customize actions feature in log alert rules is removed recently (in Nov'21). As informed in this Azure document, the new alert rule wizard does not include the option to customize the triggered alert's email or to include a custom JSON payload i.e., while managing alert rules created in the latest UI or using an API version later than 2018-04-16. However, refer this Azure document for information about how to view and manage alert rules created in the previous UI or using API version 2018-04-16 or earlier.

Currently if you still wanted to leverage the customize actions feature then I would recommend to create log alert rule as explained in this example.

I have tried it as shown in below screenshots and could see the alert rule got created with customize actions.

Also, if you wanted the customize actions feature to be available then I would recommend to raise a feature request here or upvote already existing related feature requests. In general, Azure feature team would check feasibility of a feature request, prioritize against existing feature backlog, add in roadmap as appropriate and would announce and/or update the related Azure documents once a feature request is addressed.

On the other hand, I am reaching out to our internal product team to learn and understand the reason for removing the existing customize actions feature in the new alert rule wizard or new API version. Will keep you updated as I hear more information.

Answer 2

Hi @Jatin Bhatt ,

I just tested in my lab and for a log signal Azure Monitor Alert, the email sent via an action group, I get the following details in the subject:

Fired:Sev2 Azure Monitor Alert My Custom Event - Detected on ComputerName at 1/24/2022 3:01:55 PM

There's no option in the portal to customize this subject, but the subject contains (by default) the following details:

• alert status (Fired)
• alert severity (Sev2)
• alert name (My Custom Event - Detected)
• name of the affected host (ComputerName)
• alert creted timestamp (1/24/2022 3:01:55 PM)

If you want to customize these details (email subject / body) then you could have the action group execute an Automation Runbook or Logic App where you get the alert details through payload and then send an email notification in your own custom way.

I hope the above helps!
(don't forget to mark as an answer / upvote if the answer is useful).

Thank you!
George