Azure Activity Log Alerts

Name: Azure Activity Log Alerts API
Brand: Azure Activity Log Alerts
Availability: InStock

★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring Observabilityoauth26 EndpointsREST

For Agents

Create and manage Azure Activity Log alert rules that trigger action groups when subscription events match defined conditions. Supports listing, retrieving, updating, and deleting alerts across subscriptions and resource groups.

Connect the Azure Activity Log Alerts to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Activity Log Alerts, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Azure Activity Log Alerts API.

Create activity log alert rules that fire on resource writes, service health events, or policy assignments within a subscription

List every activity log alert under a subscription or filter by resource group

Retrieve the full condition tree and action group bindings for an existing alert by name

Patch alert rules to enable, disable, or retag them without recreating the resource

GET STARTED

Start building with Azure Activity Log Alerts API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Azure Activity Log Alerts, keeping it validated and agent-ready.

The Azure Activity Log Alerts API lets agents configure rules that fire when subscription-level events occur in Azure, such as resource writes, service health incidents, or policy actions. It exposes CRUD operations on activityLogAlert resources scoped to a subscription or resource group, with conditions that filter on category, level, operationName, and target resource. Alerts can be wired to action groups so that downstream notifications (email, SMS, webhooks) trigger automatically when the activity log records a matching event.

Use Cases

Patterns agents use Azure Activity Log Alerts API for, with concrete tasks.

★ Subscription-Wide Audit Alerting

Trigger notifications whenever a write or delete operation is recorded against any resource in an Azure subscription. The Activity Log Alerts API lets you create rules that match on operationName and category=Administrative, then forward each match to an action group for paging or webhook delivery. A typical rollout covers a single subscription with three to five alerts and takes under an hour to wire end to end.

Create an activityLogAlert named AdminWrites in resource group monitoring-rg that fires on category=Administrative and operationName=Microsoft.Resources/deployments/write, scoped to the current subscription, and bind it to an existing action group.

Service Health Incident Response

Alert on-call teams the moment Azure publishes a Service Health event affecting your services. Use the Activity Log Alerts API to filter the ServiceHealth category by impacted service and region, then dispatch the alert to an action group with SMS and webhook receivers. This replaces manual portal checks with structured, programmable notifications that integrate with incident management tools.

Create an activityLogAlert that matches ServiceHealth events for Storage and SQL Database in westeurope, and route it to an action group named oncall-paging.

Policy Compliance Tracking

Detect when Azure Policy assignments are created, updated, or removed so governance teams can review changes in near real time. The API supports filtering on resourceProvider=Microsoft.Authorization and operationName patterns covering policyAssignments, with results pushed to an action group. Rules can be deployed across many subscriptions via the same JSON template.

Create an activityLogAlert that fires on Microsoft.Authorization/policyAssignments/write events across the subscription and notifies the governance action group.

Agent-Driven Alert Hygiene

Use a Jentic agent to audit and remediate activity log alerts at scale. The agent enumerates alerts via ActivityLogAlerts_ListBySubscriptionId, identifies disabled or duplicate rules, and either patches or deletes them through the same API. This converts a portal-driven cleanup task into a deterministic, repeatable workflow callable from any LLM framework.

List every activity log alert in subscription 1111-2222, find rules where enabled=false, and delete each one via ActivityLogAlerts_Delete.

Key Endpoints

6 endpoints — the azure activity log alerts api lets agents configure rules that fire when subscription-level events occur in azure, such as resource writes, service health incidents, or policy actions.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/microsoft.insights/activityLogAlerts

List activity log alerts in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts

List activity log alerts in a resource group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Get a single activity log alert

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Create or update an activity log alert

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Update tags or enabled state of an alert

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Delete an activity log alert

GET

/subscriptions/{subscriptionId}/providers/microsoft.insights/activityLogAlerts

List activity log alerts in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts

List activity log alerts in a resource group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Get a single activity log alert

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Create or update an activity log alert

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Azure AD OAuth client credentials and tenant IDs are stored encrypted in the Jentic MAXsystem vault. Agents call the activity log alerts endpoints with a scoped bearer token issued at runtime — service principal secrets never enter the agent's prompt or memory.

Intent-based discovery

Agents search Jentic by intent (e.g. "create azure activity log alert") and Jentic returns the matching ActivityLogAlerts operation with its full request schema, so the agent can construct the conditions and actions blocks without parsing ARM docs.

Time to first call

Direct integration: 1-2 days for AAD app registration, token caching, ARM polling, and error handling. Through Jentic: under 30 minutes — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Azure Action Groups

Defines the email, SMS, and webhook receivers that activity log alerts trigger.

Use alongside this API whenever creating or updating alerts — every activityLogAlert references at least one action group ID.

Complementary

Azure Alerts Management Service Resource Provider

Queries fired alert instances, history, and summaries across Azure Monitor.

Choose this when the agent needs to read alert state and history rather than configure alert rules.

Alternative

PagerDuty API

External incident routing for teams that prefer PagerDuty over Azure action groups.

Choose PagerDuty when on-call routing, escalation policies, and incident lifecycle live outside Azure.

FAQs

Specific to using Azure Activity Log Alerts API through Jentic.

What authentication does the Azure Activity Log Alerts API use?

It uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope against https://management.azure.com/. Through Jentic, the OAuth client credentials are stored in the MAXsystem vault and the agent receives a scoped bearer token at execution time, so raw secrets never enter the agent context.

Can I create a service health alert with this API?

Yes. PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName} with a condition allOf entry where field=category and equals=ServiceHealth, plus filters on impacted services and regions, and bind it to an action group via the actions.actionGroups array.

What are the rate limits for the Azure Activity Log Alerts API?

Azure Resource Manager applies subscription-level throttling, typically 12,000 read and 1,200 write operations per hour per subscription, shared with other ARM calls. The API does not expose per-endpoint quotas in the spec; agents should respect 429 responses and the Retry-After header.

How do I list all activity log alerts in a resource group through Jentic?

Search Jentic for "list azure activity log alerts", load the schema for ActivityLogAlerts_ListByResourceGroup, then execute with subscriptionId and resourceGroupName parameters. The matching endpoint is GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts. Get an API key at https://app.jentic.com/sign-up.

Is the Azure Activity Log Alerts API free?

The control plane calls themselves are free, but each activity log alert rule and the linked action group notifications are billed under Azure Monitor pricing — alert rules are charged per rule per month and action group notifications are priced per email, SMS, or webhook delivery.

How does this API differ from metric alerts?

Activity log alerts fire on management plane events recorded in the Azure Activity Log (resource writes, service health, policy actions). Metric alerts fire on time-series telemetry such as CPU or request latency. Use this API only for event-driven alerting; for metric thresholds use the Microsoft.Insights metricAlerts resource type.