Verify that Activity Log Alert exists for Create Policy Assignment

Why this matters

Creating or modifying Azure Policy Assignments can directly impact your organization’s compliance posture. If these changes go unmonitored, malicious or unintended policy assignments may take effect unnoticed.

By configuring an Activity Log Alert for the Create Policy Assignment operation (Microsoft.Authorization/policyAssignments/write), you ensure your team is immediately notified when such changes occur. This improves your ability to detect and investigate unauthorized modifications to policy enforcement mechanisms.

What this check does

This Auto Check verifies that an Activity Log Alert exists for the operation:

Microsoft.Authorization/policyAssignments/write

Check Logic:
Passes if:

At least one active alert rule exists with:

• Category set to Administrative
• Operation name equal to Microsoft.Authorization/policyAssignments/write
• No filters applied on level, status, or caller
• An Action Group assigned to notify relevant stakeholders

Fails if:

• No such alert rule is found across the configured subscriptions.
• The check queries Azure Monitor using the Azure API to evaluate alert conditions and rule existence.

How to fix it

You can create this Activity Log Alert using the Azure Portal, CLI, or PowerShell.

Azure Portal:

1. Go to Monitor > Alerts > Alert rules.
2. Click Create > Alert rule.
3. Under Scope, select the relevant subscription.
4. Under Condition, select:
5. Signal: Create policy assignment
6. Operation: Microsoft.Authorization/policyAssignments/write
7. Category: Administrative
8. Under Actions, select an existing Action Group or create a new one to notify your team.
9. Under Details, provide an alert name and description.
10. Click Review + create, then Create.

Azure CLI:

az monitor activity-log alert create \  --name "<activity log rule name>" \  --resource-group "<resource group name>" \  --scope "/subscriptions/<subscription ID>" \  --condition category=Administrative and operationName=Microsoft.Authorization/policyAssignments/write \  --action-group <action group ID> \  --enabled true 

PowerShell:

$conditions = @() $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal "Administrative" -Field "category" $conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal "Microsoft.Authorization/policyAssignments/write" -Field "operationName" $actionGroup = Get-AzActionGroup -ResourceGroupName "<resource group name>" -Name "<action group name>" $actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id $scope = "/subscriptions/<subscription ID>" New-AzActivityLogAlert -Name "<activity alert rule name>" `  -ResourceGroupName "<resource group name>" `  -Condition $conditions `  -Scope $scope `  -Location "global" `  -Action $actionObject `  -Subscription "<subscription ID>" `  -Enabled $true

Exceptions

There are no acceptable exceptions. All environments should have alerts configured for policy assignment events. If such alerts are managed through an external SIEM or compliance platform, ensure equivalence is documented and auditable.

Further resources

• Create Activity Log Alerts (Azure Portal)
• Azure REST API: Create or update Activity Log Alerts
• Azure Policy Assignments API
• Azure Monitor CLI documentation
• Azure Security Benchmark: Logging and Threat Detection