Microsoft Azure Azure Activity Log Alerts
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring Observabilityoauth26 EndpointsREST
For Agents
Create and manage Azure Activity Log alert rules that trigger action groups when subscription events match defined conditions. Supports listing, retrieving, updating, and deleting alerts across subscriptions and resource groups.
Use for: I need to create an activity log alert for resource deletions in my subscription, List all activity log alerts in resource group rg-prod, Retrieve the conditions for the activityLogAlert named ServiceHealthAlert, Disable an activity log alert without deleting the rule
Not supported: Does not handle metric alerts, log search alerts, or alert instance history — use for activity log alert rule configuration only.
The Azure Activity Log Alerts API lets agents configure rules that fire when subscription-level events occur in Azure, such as resource writes, service health incidents, or policy actions. It exposes CRUD operations on activityLogAlert resources scoped to a subscription or resource group, with conditions that filter on category, level, operationName, and target resource. Alerts can be wired to action groups so that downstream notifications (email, SMS, webhooks) trigger automatically when the activity log records a matching event.
Install Jentic One Beta
Connect the Azure Activity Log Alerts to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Activity Log Alerts, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Azure Activity Log Alerts API.
Create activity log alert rules that fire on resource writes, service health events, or policy assignments within a subscription
List every activity log alert under a subscription or filter by resource group
Retrieve the full condition tree and action group bindings for an existing alert by name
Patch alert rules to enable, disable, or retag them without recreating the resource
Delete obsolete activity log alerts to keep the alerting surface clean
Bind alerts to action groups so each matching event invokes email, SMS, or webhook receivers
Use Cases
Patterns agents use Azure Activity Log Alerts API for, with concrete tasks.
★ Subscription-Wide Audit Alerting
Trigger notifications whenever a write or delete operation is recorded against any resource in an Azure subscription. The Activity Log Alerts API lets you create rules that match on operationName and category=Administrative, then forward each match to an action group for paging or webhook delivery. A typical rollout covers a single subscription with three to five alerts and takes under an hour to wire end to end.
Create an activityLogAlert named AdminWrites in resource group monitoring-rg that fires on category=Administrative and operationName=Microsoft.Resources/deployments/write, scoped to the current subscription, and bind it to an existing action group.
Service Health Incident Response
Alert on-call teams the moment Azure publishes a Service Health event affecting your services. Use the Activity Log Alerts API to filter the ServiceHealth category by impacted service and region, then dispatch the alert to an action group with SMS and webhook receivers. This replaces manual portal checks with structured, programmable notifications that integrate with incident management tools.
Create an activityLogAlert that matches ServiceHealth events for Storage and SQL Database in westeurope, and route it to an action group named oncall-paging.
Policy Compliance Tracking
Detect when Azure Policy assignments are created, updated, or removed so governance teams can review changes in near real time. The API supports filtering on resourceProvider=Microsoft.Authorization and operationName patterns covering policyAssignments, with results pushed to an action group. Rules can be deployed across many subscriptions via the same JSON template.
Create an activityLogAlert that fires on Microsoft.Authorization/policyAssignments/write events across the subscription and notifies the governance action group.
Agent-Driven Alert Hygiene
Use a Jentic agent to audit and remediate activity log alerts at scale. The agent enumerates alerts via ActivityLogAlerts_ListBySubscriptionId, identifies disabled or duplicate rules, and either patches or deletes them through the same API. This converts a portal-driven cleanup task into a deterministic, repeatable workflow callable from any LLM framework.
List every activity log alert in subscription 1111-2222, find rules where enabled=false, and delete each one via ActivityLogAlerts_Delete.
Key Endpoints
6 endpoints — the azure activity log alerts api lets agents configure rules that fire when subscription-level events occur in azure, such as resource writes, service health incidents, or policy actions.
METHOD
PATH
DESCRIPTION
GET
/subscriptions/{subscriptionId}/providers/microsoft.insights/activityLogAlerts
List activity log alerts in a subscription
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts
List activity log alerts in a resource group
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}
Get a single activity log alert
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}
Create or update an activity log alert
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}
Update tags or enabled state of an alert
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}
Delete an activity log alert
GET
/subscriptions/{subscriptionId}/providers/microsoft.insights/activityLogAlerts
List activity log alerts in a subscription
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts
List activity log alerts in a resource group
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}
Get a single activity log alert
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}
Create or update an activity log alert
PATCH
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}
Update tags or enabled state of an alert
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}
Delete an activity log alert
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Azure AD OAuth client credentials and tenant IDs are stored encrypted in the Jentic MAXsystem vault. Agents call the activity log alerts endpoints with a scoped bearer token issued at runtime — service principal secrets never enter the agent's prompt or memory.
Intent-based discovery
Agents search Jentic by intent (e.g. "create azure activity log alert") and Jentic returns the matching ActivityLogAlerts operation with its full request schema, so the agent can construct the conditions and actions blocks without parsing ARM docs.
Time to first call
Direct integration: 1-2 days for AAD app registration, token caching, ARM polling, and error handling. Through Jentic: under 30 minutes — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Azure Activity Log Alerts API through Jentic.
What authentication does the Azure Activity Log Alerts API use?
It uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope against https://management.azure.com/. Through Jentic, the OAuth client credentials are stored in the MAXsystem vault and the agent receives a scoped bearer token at execution time, so raw secrets never enter the agent context.
Can I create a service health alert with this API?
Yes. PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName} with a condition allOf entry where field=category and equals=ServiceHealth, plus filters on impacted services and regions, and bind it to an action group via the actions.actionGroups array.
What are the rate limits for the Azure Activity Log Alerts API?
Azure Resource Manager applies subscription-level throttling, typically 12,000 read and 1,200 write operations per hour per subscription, shared with other ARM calls. The API does not expose per-endpoint quotas in the spec; agents should respect 429 responses and the Retry-After header.
How do I list all activity log alerts in a resource group through Jentic?
Search Jentic for "list azure activity log alerts", load the schema for ActivityLogAlerts_ListByResourceGroup, then execute with subscriptionId and resourceGroupName parameters. The matching endpoint is GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts. Get an API key at https://app.jentic.com/sign-up.
Is the Azure Activity Log Alerts API free?
The control plane calls themselves are free, but each activity log alert rule and the linked action group notifications are billed under Azure Monitor pricing — alert rules are charged per rule per month and action group notifications are priced per email, SMS, or webhook delivery.
How does this API differ from metric alerts?
Activity log alerts fire on management plane events recorded in the Azure Activity Log (resource writes, service health, policy actions). Metric alerts fire on time-series telemetry such as CPU or request latency. Use this API only for event-driven alerting; for metric thresholds use the Microsoft.Insights metricAlerts resource type.
GET STARTED