Microsoft Azure Azure Activity Log Alerts

Name: Azure Activity Log Alerts API
Brand: Azure Activity Log Alerts
Availability: InStock

★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring Observabilityoauth26 Endpoints

Install Jentic One Beta

Connect the Azure Activity Log Alerts to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Azure Activity Log Alerts, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Azure Activity Log Alerts API.

Create activity log alert rules that fire on resource writes, service health events, or policy assignments within a subscription

List every activity log alert under a subscription or filter by resource group

Retrieve the full condition tree and action group bindings for an existing alert by name

GET STARTED

Start building with Azure Activity Log Alerts API

Explore with Jentic

View OpenAPI Document

For Agents

Create and manage Azure Activity Log alert rules that trigger action groups when subscription events match defined conditions. Supports listing, retrieving, updating, and deleting alerts across subscriptions and resource groups.

Use for: I need to create an activity log alert for resource deletions in my subscription, List all activity log alerts in resource group rg-prod, Retrieve the conditions for the activityLogAlert named ServiceHealthAlert, Disable an activity log alert without deleting the rule

Not supported: Does not handle metric alerts, log search alerts, or alert instance history - use for activity log alert rule configuration only.

Use Cases

Patterns agents use Azure Activity Log Alerts API for, with concrete tasks.

★ Subscription-Wide Audit Alerting

Trigger notifications whenever a write or delete operation is recorded against any resource in an Azure subscription. The Activity Log Alerts API lets you create rules that match on operationName and category=Administrative, then forward each match to an action group for paging or webhook delivery. A typical rollout covers a single subscription with three to five alerts and takes under an hour to wire end to end.

Create an activityLogAlert named AdminWrites in resource group monitoring-rg that fires on category=Administrative and operationName=Microsoft.Resources/deployments/write, scoped to the current subscription, and bind it to an existing action group.

Service Health Incident Response

Alert on-call teams the moment Azure publishes a Service Health event affecting your services. Use the Activity Log Alerts API to filter the ServiceHealth category by impacted service and region, then dispatch the alert to an action group with SMS and webhook receivers. This replaces manual portal checks with structured, programmable notifications that integrate with incident management tools.

Create an activityLogAlert that matches ServiceHealth events for Storage and SQL Database in westeurope, and route it to an action group named oncall-paging.

Policy Compliance Tracking

Detect when Azure Policy assignments are created, updated, or removed so governance teams can review changes in near real time. The API supports filtering on resourceProvider=Microsoft.Authorization and operationName patterns covering policyAssignments, with results pushed to an action group. Rules can be deployed across many subscriptions via the same JSON template.

Create an activityLogAlert that fires on Microsoft.Authorization/policyAssignments/write events across the subscription and notifies the governance action group.

Agent-Driven Alert Hygiene

Use a Jentic agent to audit and remediate activity log alerts at scale. The agent enumerates alerts via ActivityLogAlerts_ListBySubscriptionId, identifies disabled or duplicate rules, and either patches or deletes them through the same API. This converts a portal-driven cleanup task into a deterministic, repeatable workflow callable from any LLM framework.

List every activity log alert in subscription 1111-2222, find rules where enabled=false, and delete each one via ActivityLogAlerts_Delete.

Key Endpoints

6 endpoints — the azure activity log alerts api lets agents configure rules that fire when subscription-level events occur in azure, such as resource writes, service health incidents, or policy actions.

METHOD

PATH

DESCRIPTION

GET

/subscriptions/{subscriptionId}/providers/microsoft.insights/activityLogAlerts

List activity log alerts in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts

List activity log alerts in a resource group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Get a single activity log alert

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Create or update an activity log alert

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Update tags or enabled state of an alert

DELETE

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Delete an activity log alert

GET

/subscriptions/{subscriptionId}/providers/microsoft.insights/activityLogAlerts

List activity log alerts in a subscription

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts

List activity log alerts in a resource group

GET

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Get a single activity log alert

PUT

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Create or update an activity log alert

PATCH

/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName}

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create an Azure activity log alert for resource deletions' or 'list activity log alerts in a resource group', and Jentic returns the matching ActivityLogAlerts operation with its full request schema so the agent can build the conditions and actions blocks without parsing ARM docs.

Time to first call

FAQs

Specific to using Azure Activity Log Alerts API through Jentic.

What authentication does the Azure Activity Log Alerts API use?

It uses Azure Active Directory OAuth 2.0 (the azure_auth scheme) with the user_impersonation scope against https://management.azure.com/. Through Jentic, the OAuth client credentials are stored in your Jentic One instance and the agent receives a scoped bearer token at execution time, so raw secrets never enter the agent context.

Can I create a service health alert with this API?

Yes. PUT to /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts/{activityLogAlertName} with a condition allOf entry where field=category and equals=ServiceHealth, plus filters on impacted services and regions, and bind it to an action group via the actions.actionGroups array.

What are the rate limits for the Azure Activity Log Alerts API?

Azure Resource Manager applies subscription-level throttling, typically 12,000 read and 1,200 write operations per hour per subscription, shared with other ARM calls. The API does not expose per-endpoint quotas in the spec; agents should respect 429 responses and the Retry-After header.

How do I list all activity log alerts in a resource group through Jentic?

Search Jentic for "list azure activity log alerts", load the schema for ActivityLogAlerts_ListByResourceGroup, then execute with subscriptionId and resourceGroupName parameters. The matching endpoint is GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/microsoft.insights/activityLogAlerts. Get an API key through Jentic One, the self-hosted execution layer.

Is the Azure Activity Log Alerts API free?

The control plane calls themselves are free, but each activity log alert rule and the linked action group notifications are billed under Azure Monitor pricing - alert rules are charged per rule per month and action group notifications are priced per email, SMS, or webhook delivery.

How does this API differ from metric alerts?

Activity log alerts fire on management plane events recorded in the Azure Activity Log (resource writes, service health, policy actions). Metric alerts fire on time-series telemetry such as CPU or request latency. Use this API only for event-driven alerting; for metric thresholds use the Microsoft.Insights metricAlerts resource type.

Can I limit what my agent is allowed to do with the Azure Activity Log Alerts API?

Yes. Because you run Jentic One yourself, your own rules decide which operations and credentials the agent may use, and this API places the subscription, resource group, and alert name in the URL path so you can pin the agent to a specific scope. You choose which operations it can call, so you can permit read-only actions like listing and retrieving activity log alerts while leaving out destructive ones such as deleting an alert rule or overwriting it with a create-or-update. The Azure AD credential is injected only at execution time, so the agent can act only within the operations and scope you have granted.

Microsoft Azure Azure Activity Log Alerts

Connect the Azure Activity Log Alerts to your agent

Capabilities

Start building with Azure Activity Log Alerts API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs