Azure Monitor Azure-Microsoft.Insights

operationName	Description	Sample	Rule
any	Catch-all for Azure-Microsoft.Insights rules that match the resource provider but no specific operation.	N	N
Microsoft.Insights/ActionGroups/Delete	Delete an action group	Y	Y
Microsoft.Insights/actionGroups/NetworkSecurityPerimeterAssociationProxies/Delete	Delete a action group endpoint NSP association proxy	N	N
Microsoft.Insights/actionGroups/NetworkSecurityPerimeterAssociationProxies/Write	Create or update a action group endpoint NSP association proxy	N	N
Microsoft.Insights/actionGroups/NetworkSecurityPerimeterConfigurations/Reconcile/Action	Reconcile action group endpoint NSP configuration	N	N
Microsoft.Insights/ActionGroups/Write	Create or update an action group	Y	N
Microsoft.Insights/ActivityLogAlerts/Activated/Action	Activity Log Alert activated	Y	N
Microsoft.Insights/ActivityLogAlerts/Delete	Delete an activity log alert	Y	N
Microsoft.Insights/ActivityLogAlerts/Write	Create or update an activity log alert	Y	N
Microsoft.Insights/AlertRules/Activated/Action	Classic metric alert activated	N	N
Microsoft.Insights/AlertRules/Delete	Delete a classic metric alert	N	Y
Microsoft.Insights/AlertRules/Resolved/Action	Classic metric alert resolved	N	N
Microsoft.Insights/AlertRules/Throttled/Action	Classic metric alert rule throttled	N	N
Microsoft.Insights/AlertRules/Write	Create or update a classic metric alert	N	N
Microsoft.Insights/AutoscaleSettings/Delete	Delete an autoscale setting	N	N
Microsoft.Insights/AutoscaleSettings/PredictiveScaleup/Action	Predictive Autoscale scale up initiated	N	N
Microsoft.Insights/AutoscaleSettings/PredictiveScaleupResult/Action	Predictive Autoscale scale up completed	N	N
Microsoft.Insights/AutoscaleSettings/providers/Microsoft.Insights/diagnosticSettings/Write	Create or update a resource diagnostic setting	N	N
Microsoft.Insights/AutoscaleSettings/Scaledown/Action	Autoscale scale down initiated	N	N
Microsoft.Insights/AutoscaleSettings/ScaledownResult/Action	Autoscale scale down completed	N	N
Microsoft.Insights/AutoscaleSettings/Scaleup/Action	Autoscale scale up initiated	N	N
Microsoft.Insights/AutoscaleSettings/ScaleupResult/Action	Autoscale scale up completed	N	N
Microsoft.Insights/AutoscaleSettings/Write	Create or update an autoscale setting	N	N
Microsoft.Insights/Components/AnalyticsItems/Delete	Deleting an Application Insights analytics item	N	N
Microsoft.Insights/Components/AnalyticsItems/Write	Writing an Application Insights analytics item	N	N
Microsoft.Insights/Components/AnalyticsTables/Action	Application Insights analytics table action	N	N
Microsoft.Insights/Components/AnalyticsTables/Delete	Deleting an Application Insights analytics table schema	N	N
Microsoft.Insights/Components/AnalyticsTables/Write	Writing an Application Insights analytics table schema	N	N
Microsoft.Insights/Components/Annotations/Delete	Deleting an Application Insights annotation	N	N
Microsoft.Insights/Components/Annotations/Write	Writing an Application Insights annotation	N	N
Microsoft.Insights/Components/ApiKeys/Action	Generating an Application Insights API key	N	N
Microsoft.Insights/Components/ApiKeys/Delete	Deleting an Application Insights API key	N	N
Microsoft.Insights/Components/CurrentBillingFeatures/Write	Writing current billing features for Application Insights component	N	N
Microsoft.Insights/Components/DailyCapReached/Action	Reached the daily cap for Application Insights component	N	N
Microsoft.Insights/Components/DailyCapWarningThresholdReached/Action	Reached the daily cap warning threshold for Application Insights component	N	N
Microsoft.Insights/Components/Delete	Deleting an application insights component configuration	Y	N
Microsoft.Insights/Components/ExportConfiguration/Action	Application Insights export settings action	N	N
Microsoft.Insights/Components/ExportConfiguration/Delete	Deleting Application Insights export settings	N	N
Microsoft.Insights/Components/ExportConfiguration/Write	Writing Application Insights export settings	N	N
Microsoft.Insights/Components/Favorites/Delete	Deleting an Application Insights favorite	N	N
Microsoft.Insights/Components/Favorites/Write	Writing an Application Insights favorite	N	N
Microsoft.Insights/Components/linkedStorageAccounts/Write	Create or modify linked storage account	N	N
Microsoft.Insights/Components/Move/Action	Move an Application Insights Component to another resource group or subscription	N	N
Microsoft.Insights/Components/MyAnalyticsItems/Delete	Deleting an Application Insights personal analytics item	N	N
Microsoft.Insights/Components/MyAnalyticsItems/Write	Writing an Application Insights personal analytics item	N	N
Microsoft.Insights/Components/PricingPlans/Write	Writing an Application Insights component pricing plan	N	N
Microsoft.Insights/Components/ProactiveDetectionConfigs/Write	Writing Application Insights proactive detection configuration	N	N
Microsoft.Insights/Components/providers/Microsoft.Insights/diagnosticSettings/Write	Create or update a resource diagnostic setting	N	N
Microsoft.Insights/Components/Purge/Action	Purging data from Application Insights	N	N
Microsoft.Insights/Components/WorkItemConfigs/Delete	Deleting an Application Insights ALM integration configuration	N	N
Microsoft.Insights/Components/WorkItemConfigs/Write	Writing an Application Insights ALM integration configuration	N	N
Microsoft.Insights/Components/Write	Writing to an application insights component configuration	Y	N
Microsoft.Insights/CreateNotifications/Write	Send test notifications to the provided receiver list	N	N
Microsoft.Insights/DataCollectionEndpoints/Delete	Delete a data collection endpoint	Y	N
Microsoft.Insights/DataCollectionEndpoints/NetworkSecurityPerimeterAssociationProxies/Delete	Delete a data collection endpoint NSP association proxy	N	N
Microsoft.Insights/DataCollectionEndpoints/NetworkSecurityPerimeterAssociationProxies/Write	Create or update a data collection endpoint NSP association proxy	N	N
Microsoft.Insights/DataCollectionEndpoints/NetworkSecurityPerimeterConfigurations/Reconcile/Action	Reconcile data collection endpoint NSP configuration	N	N
Microsoft.Insights/DataCollectionEndpoints/ScopedPrivateLinkProxies/Delete	Delete a data collection endpoint private link proxy	N	N
Microsoft.Insights/DataCollectionEndpoints/ScopedPrivateLinkProxies/Write	Create or update a data collection endpoint private link proxy	N	N
Microsoft.Insights/DataCollectionEndpoints/TriggerFailback/Action	Trigger failback on a data collection endpoint	N	N
Microsoft.Insights/DataCollectionEndpoints/TriggerFailover/Action	Trigger failover on a data collection endpoint	N	N
Microsoft.Insights/DataCollectionEndpoints/Write	Create or update a data collection endpoint	Y	N
Microsoft.Insights/DataCollectionRuleAssociations/Delete	Delete a resource's association with a data collection rule	N	N
Microsoft.Insights/DataCollectionRuleAssociations/Write	Create or update a resource's association with a data collection rule	N	N
Microsoft.Insights/DataCollectionRules/Delete	Delete a data collection rule	N	N
Microsoft.Insights/DataCollectionRules/Write	Create or update a data collection rule	N	N
Microsoft.Insights/DiagnosticSettings/Delete	Delete a resource diagnostic setting	N	Y
Microsoft.Insights/DiagnosticSettings/Write	Create or update a resource diagnostic setting	Y	N
Microsoft.Insights/ExtendedDiagnosticSettings/Delete	Delete a network flow log diagnostic setting	N	N
Microsoft.Insights/ExtendedDiagnosticSettings/Write	Create or update a network flow log diagnostic setting	N	N
Microsoft.Insights/ListMigrationDate/Action	Get back Subscription migration date	N	N
Microsoft.Insights/LogProfiles/Delete	Delete an Activity Log log profile	N	N
Microsoft.Insights/LogProfiles/Write	Create or update an Activity Log log profile	N	N
Microsoft.Insights/MetricAlerts/Delete	Delete a metric alert	N	Y
Microsoft.Insights/MetricAlerts/Write	Create or update a metric alert	N	N
Microsoft.Insights/Metrics/Action	Metric Action	N	N
Microsoft.Insights/MigrateToNewpricingModel/Action	Migrate subscription to new pricing model	N	N
Microsoft.Insights/MonitoredObjects/Delete	Delete a monitored object	N	N
Microsoft.Insights/MonitoredObjects/Write	Create or update a monitored object	N	N
Microsoft.Insights/PrivateLinkScopes/Delete	Delete a private link scope	N	N
Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnectionProxies/Delete	Delete a private endpoint connection proxy	N	N
Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnectionProxies/Validate/Action	Validate a private endpoint connection proxy	N	N
Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnectionProxies/Write	Create or update a private endpoint connection proxy	N	N
Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnections/Delete	Delete a private endpoint connection	N	N
Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnections/Write	Create or update a private endpoint connection	N	N
Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnectionsApproval/action	Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider	N	N
Microsoft.Insights/PrivateLinkScopes/ScopedResources/Delete	Delete a private link scoped resource	N	N
Microsoft.Insights/PrivateLinkScopes/ScopedResources/Write	Create or update a private link scoped resource	N	N
Microsoft.Insights/PrivateLinkScopes/Write	Create or update a private link scope	N	N
Microsoft.Insights/Register/Action	Register the Microsoft Insights provider	N	N
Microsoft.Insights/RollbackToLegacyPricingModel/Action	Rollback subscription to legacy pricing model	N	N
Microsoft.Insights/ScheduledQueryRules/Delete	Deleting a scheduled query rule	N	N
Microsoft.Insights/ScheduledQueryRules/NetworkSecurityPerimeterAssociationProxies/Delete	Deleting a network security perimeter association proxy for scheduled query rules	N	N
Microsoft.Insights/ScheduledQueryRules/NetworkSecurityPerimeterAssociationProxies/Write	Writing a network security perimeter association proxy for scheduled query rules	N	N
Microsoft.Insights/ScheduledQueryRules/networkSecurityPerimeterConfigurations/Reconcile/Action	Reconciling network security perimeter configuration for scheduled query rules	N	N
Microsoft.Insights/ScheduledQueryRules/Write	Writing a scheduled query rule	N	N
Microsoft.Insights/TenantActionGroups/Delete	Delete a tenant action group	N	N
Microsoft.Insights/TenantActionGroups/Write	Create or update a tenant action group	N	N
Microsoft.Insights/Tenants/Register/Action	Initializes the Microsoft Insights provider	N	N
Microsoft.Insights/Unregister/Action	Register the Microsoft Insights provider	N	N
Microsoft.Insights/Webtests/Delete	Deleting a webtest configuration	N	N
Microsoft.Insights/Webtests/Write	Writing to a webtest configuration	N	N
Microsoft.Insights/Workbooks/Delete	Delete a workbook	N	N
Microsoft.Insights/Workbooks/Write	Create or update a workbook	N	N
Microsoft.Insights/WorkbookTemplates/Delete	Delete a workbook template	N	N
Microsoft.Insights/WorkbookTemplates/Write	Create or update a workbook template	N	N

any: Azure Monitor (catch-all)

Namespace: Microsoft.Insights

Description

Catch-all for Azure-Microsoft.Insights rules that match the resource provider but no specific operation.

Microsoft.Insights/ActionGroups/Delete

Namespace: Microsoft.Insights

Description

Delete an action group

Example Resource Log Record #

{
  "ActivityStatus": "",
  "ActivityStatusValue": "Success",
  "ActivitySubstatus": "",
  "ActivitySubstatusValue": "",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/actionGroups/zcag2",
    "action": "Microsoft.Insights/actionGroups/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/actionGroups/zcag2",
    "action": "Microsoft.Insights/actionGroups/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "Category": "",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "REDACTED",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "REDACTED",
    "rh": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "aio": "REDACTED",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "REDACTED",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
  },
  "CorrelationId": "c63f8086-9a88-4dbd-984a-178474cc29de",
  "EventDataId": "9695b7cb-59b8-15ff-19fd-076adcdfd260",
  "EventSubmissionTimestamp": "2026-06-29T18:12:09.9433398Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationId": "",
  "OperationName": "",
  "OperationNameValue": "MICROSOFT.INSIGHTS/ACTIONGROUPS/DELETE",
  "Properties": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Insights/actiongroups/zcag2",
    "message": "Microsoft.Insights/actiongroups/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "9695b7cb-59b8-15ff-19fd-076adcdfd260",
    "eventSubmissionTimestamp": "2026-06-29T18:12:09.9433398Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcag2",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Insights/actiongroups/zcag2",
    "message": "Microsoft.Insights/actiongroups/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "9695b7cb-59b8-15ff-19fd-076adcdfd260",
    "eventSubmissionTimestamp": "2026-06-29T18:12:09.9433398Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcag2",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "Resource": "",
  "ResourceGroup": "RG-LOGCAPTURE-GEN",
  "ResourceId": "",
  "ResourceProvider": "",
  "ResourceProviderValue": "MICROSOFT.INSIGHTS",
  "SourceSystem": "Azure",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222",
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T18:12:09.9433398Z",
  "Type": "AzureActivity",
  "_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.insights/actiongroups/zcag2"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`resultType` (panther rule field)	in	`Succeeded`	1 rule	panther
`resultType` (panther rule field)	in	`Success`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Azure Action Groups Deleted source informational: Detects when Azure action groups are deleted, which could disable alert notifications to security teams to prevent incident response.T1562.008

Microsoft.Insights/actionGroups/NetworkSecurityPerimeterAssociationProxies/Delete

Namespace: Microsoft.Insights

Description

Delete a action group endpoint NSP association proxy

Microsoft.Insights/actionGroups/NetworkSecurityPerimeterAssociationProxies/Write

Namespace: Microsoft.Insights

Description

Create or update a action group endpoint NSP association proxy

Microsoft.Insights/actionGroups/NetworkSecurityPerimeterConfigurations/Reconcile/Action

Namespace: Microsoft.Insights

Description

Reconcile action group endpoint NSP configuration

Microsoft.Insights/ActionGroups/Write

Namespace: Microsoft.Insights

Description

Create or update an action group

Example Resource Log Record #

{
  "ActivityStatus": "",
  "ActivityStatusValue": "Success",
  "ActivitySubstatus": "",
  "ActivitySubstatusValue": "Created",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/actionGroups/zcag3",
    "action": "Microsoft.Insights/actionGroups/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/actionGroups/zcag3",
    "action": "Microsoft.Insights/actionGroups/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "Category": "",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782755989",
    "nbf": "1782755989",
    "exp": "1782761191",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "REDACTED",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "REDACTED",
    "rh": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "5 3",
    "xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
    "xms_idrel": "1 8",
    "xms_sub_fct": "14 3",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782755989",
    "nbf": "1782755989",
    "exp": "1782761191",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "REDACTED",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "REDACTED",
    "rh": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "5 3",
    "xms_ftd": "Mj7nU8nvfbVTGrVoiK4tJdjxisbwx4DqUPRFiszWj-UBdXNub3J0aC1kc21z",
    "xms_idrel": "1 8",
    "xms_sub_fct": "14 3",
    "xms_tcdt": "1768616282"
  },
  "CorrelationId": "7320fc66-2dab-4845-b9a0-1ed991a8dda5",
  "EventDataId": "c19ad471-0e91-0930-d975-024e1f8418b5",
  "EventSubmissionTimestamp": "2026-06-29T19:04:03.3565667Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationId": "",
  "OperationName": "",
  "OperationNameValue": "MICROSOFT.INSIGHTS/ACTIONGROUPS/WRITE",
  "Properties": {
    "statusCode": "Created",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/actionGroups/zcag3",
    "message": "Microsoft.Insights/actionGroups/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "c19ad471-0e91-0930-d975-024e1f8418b5",
    "eventSubmissionTimestamp": "2026-06-29T19:04:03.3565667Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcag3",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "Created"
  },
  "Properties_d": {
    "statusCode": "Created",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/actionGroups/zcag3",
    "message": "Microsoft.Insights/actionGroups/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "c19ad471-0e91-0930-d975-024e1f8418b5",
    "eventSubmissionTimestamp": "2026-06-29T19:04:03.3565667Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "zcag3",
    "resourceGroup": "RG-LOGCAPTURE-GEN",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "Created"
  },
  "Resource": "",
  "ResourceGroup": "RG-LOGCAPTURE-GEN",
  "ResourceId": "",
  "ResourceProvider": "",
  "ResourceProviderValue": "MICROSOFT.INSIGHTS",
  "SourceSystem": "Azure",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222",
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T19:04:03.3565667Z",
  "Type": "AzureActivity",
  "_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.insights/actiongroups/zcag3"
}

Microsoft.Insights/ActivityLogAlerts/Activated/Action

Namespace: Microsoft.Insights

Description

Activity Log Alert activated

Example Resource Log Record #

{
  "ActivityStatus": "",
  "ActivityStatusValue": "Succeeded",
  "ActivitySubstatus": "",
  "ActivitySubstatusValue": "",
  "Authorization": "",
  "Authorization_d": "None",
  "Caller": "",
  "CallerIpAddress": "",
  "Category": "",
  "CategoryValue": "Alert",
  "Claims": "",
  "Claims_d": "None",
  "CorrelationId": "9c77ebc7-44a9-4722-b0f8-0bc0db8411b4",
  "EventDataId": "6f795318-4f00-42c1-955f-28e4d2addeea",
  "EventSubmissionTimestamp": "2026-06-29T18:07:10.8340215Z",
  "HTTPRequest": "",
  "Hierarchy": "",
  "Level": "Informational",
  "OperationId": "",
  "OperationName": "",
  "OperationNameValue": "Microsoft.Insights/ActivityLogAlerts/Activated/action",
  "Properties": {
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "tenantId": "11111111-1111-1111-1111-111111111111",
    "eventDataId": "6f795318-4f00-42c1-955f-28e4d2addeea",
    "resourceGroup": "rg-logcapture-gen",
    "resourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Resources/deployments/vm_deploy_6hWz04CZWJL8g6USfIXNheOnqPcWQAd6",
    "eventTimestamp": "6/29/2026 6:02:38 PM",
    "operationName": "Microsoft.Resources/deployments/write",
    "status": "Started",
    "eventSubmissionTimestamp": "2026-06-29T18:07:10.8340215Z",
    "resource": "zcala",
    "resourceProviderValue": "microsoft.insights",
    "activityStatusValue": "Succeeded"
  },
  "Properties_d": {
    "eventDataId": "6f795318-4f00-42c1-955f-28e4d2addeea",
    "eventSubmissionTimestamp": "2026-06-29T18:07:10.8340215Z",
    "resource": "zcala",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "microsoft.insights",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Succeeded",
    "tenantId": "11111111-1111-1111-1111-111111111111",
    "resourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Resources/deployments/vm_deploy_6hWz04CZWJL8g6USfIXNheOnqPcWQAd6",
    "eventTimestamp": "6/29/2026 6:02:38 PM",
    "operationName": "Microsoft.Resources/deployments/write",
    "status": "Started"
  },
  "Resource": "",
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceId": "",
  "ResourceProvider": "",
  "ResourceProviderValue": "microsoft.insights",
  "SourceSystem": "Azure",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222",
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T18:07:10.8340215Z",
  "Type": "AzureActivity",
  "_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/microsoft.insights/activitylogalerts/zcala"
}

Microsoft.Insights/ActivityLogAlerts/Delete

Namespace: Microsoft.Insights

Description

Delete an activity log alert

Example Resource Log Record #

{
  "ActivityStatusValue": "Success",
  "ActivitySubstatusValue": "NoContent",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/activityLogAlerts/dwhp3bbd4cala",
    "action": "Microsoft.Insights/activityLogAlerts/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/activityLogAlerts/dwhp3bbd4cala",
    "action": "Microsoft.Insights/activityLogAlerts/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "1111111111111111",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
  },
  "CorrelationId": "ec30e150-ad20-418f-8058-3a2fdfcae8f2",
  "EventDataId": "2236da13-157c-52b4-5d54-b64fb123168d",
  "EventSubmissionTimestamp": "2026-07-03T01:48:26.4397449Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationNameValue": "MICROSOFT.INSIGHTS/ACTIVITYLOGALERTS/DELETE",
  "Properties": {
    "statusCode": "NoContent",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/activityLogAlerts/dwhp3bbd4cala",
    "message": "Microsoft.Insights/activityLogAlerts/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "2236da13-157c-52b4-5d54-b64fb123168d",
    "eventSubmissionTimestamp": "2026-07-03T01:48:26.4397449Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhp3bbd4cala",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "NoContent"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/activityLogAlerts/dwhp3bbd4cala",
    "message": "Microsoft.Insights/activityLogAlerts/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "2236da13-157c-52b4-5d54-b64fb123168d",
    "eventSubmissionTimestamp": "2026-07-03T01:48:26.4397449Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhp3bbd4cala",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "statusCode": "NoContent",
    "serviceRequestId": "",
    "activitySubstatusValue": "NoContent"
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.INSIGHTS",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Microsoft.Insights/ActivityLogAlerts/Write

Namespace: Microsoft.Insights

Description

Create or update an activity log alert

Example Resource Log Record #

{
  "ActivityStatusValue": "Failure",
  "ActivitySubstatusValue": "BadRequest",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/activityLogAlerts/dwhp3bbd4cala",
    "action": "Microsoft.Insights/activityLogAlerts/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/activityLogAlerts/dwhp3bbd4cala",
    "action": "Microsoft.Insights/activityLogAlerts/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783057703",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282",
    "correlationid": "00b19dbe-ce18-40ce-9099-2c45321389fb"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783057703",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "correlationid": "00b19dbe-ce18-40ce-9099-2c45321389fb",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "1111111111111111",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
  },
  "CorrelationId": "00b19dbe-ce18-40ce-9099-2c45321389fb",
  "EventDataId": "e00b1a76-80f5-702c-e9bf-9138c3dd1cdb",
  "EventSubmissionTimestamp": "2026-07-03T01:48:24.8572803Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Error",
  "OperationNameValue": "MICROSOFT.INSIGHTS/ACTIVITYLOGALERTS/WRITE",
  "Properties": {
    "statusCode": "BadRequest",
    "serviceRequestId": "",
    "statusMessage": {
      "code": "UnsupportedCondition",
      "message": "Alert Rule with category 'Administrative' and subscription scope must have at least one additional filtering condition. Activity ID: 00b19dbe-ce18-40ce-9099-2c45321389fb."
    },
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/activityLogAlerts/dwhp3bbd4cala",
    "message": "Microsoft.Insights/activityLogAlerts/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "e00b1a76-80f5-702c-e9bf-9138c3dd1cdb",
    "eventSubmissionTimestamp": "2026-07-03T01:48:24.8572803Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhp3bbd4cala",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Failure",
    "activitySubstatusValue": "BadRequest"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/activityLogAlerts/dwhp3bbd4cala",
    "message": "Microsoft.Insights/activityLogAlerts/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "e00b1a76-80f5-702c-e9bf-9138c3dd1cdb",
    "eventSubmissionTimestamp": "2026-07-03T01:48:24.8572803Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhp3bbd4cala",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Failure",
    "statusCode": "BadRequest",
    "serviceRequestId": "",
    "activitySubstatusValue": "BadRequest",
    "statusMessage": {
      "code": "UnsupportedCondition",
      "message": "Alert Rule with category 'Administrative' and subscription scope must have at least one additional filtering condition. Activity ID: 00b19dbe-ce18-40ce-9099-2c45321389fb."
    }
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.INSIGHTS",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Microsoft.Insights/AlertRules/Activated/Action

Namespace: Microsoft.Insights

Description

Classic metric alert activated

Microsoft.Insights/AlertRules/Delete

Namespace: Microsoft.Insights

Description

Delete a classic metric alert

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`resultType` (panther rule field)	in	`Succeeded`	1 rule	panther
`resultType` (panther rule field)	in	`Success`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Azure Alert Rules Deleted source medium: Detects when Azure alert rules are deleted. Deleting alert rules disables security notifications and is a common defense evasion technique.T1562.008↳ also matches Microsoft.Insights/MetricAlerts/Delete

Microsoft.Insights/AlertRules/Resolved/Action

Namespace: Microsoft.Insights

Description

Classic metric alert resolved

Microsoft.Insights/AlertRules/Throttled/Action

Namespace: Microsoft.Insights

Description

Classic metric alert rule throttled

Microsoft.Insights/AlertRules/Write

Namespace: Microsoft.Insights

Description

Create or update a classic metric alert

Microsoft.Insights/AutoscaleSettings/Delete

Namespace: Microsoft.Insights

Description

Delete an autoscale setting

Microsoft.Insights/AutoscaleSettings/PredictiveScaleup/Action

Namespace: Microsoft.Insights

Description

Predictive Autoscale scale up initiated

Microsoft.Insights/AutoscaleSettings/PredictiveScaleupResult/Action

Namespace: Microsoft.Insights

Description

Predictive Autoscale scale up completed

Microsoft.Insights/AutoscaleSettings/providers/Microsoft.Insights/diagnosticSettings/Write

Namespace: Microsoft.Insights

Description

Create or update a resource diagnostic setting

Microsoft.Insights/AutoscaleSettings/Scaledown/Action

Namespace: Microsoft.Insights

Description

Autoscale scale down initiated

Microsoft.Insights/AutoscaleSettings/ScaledownResult/Action

Namespace: Microsoft.Insights

Description

Autoscale scale down completed

Microsoft.Insights/AutoscaleSettings/Scaleup/Action

Namespace: Microsoft.Insights

Description

Autoscale scale up initiated

Microsoft.Insights/AutoscaleSettings/ScaleupResult/Action

Namespace: Microsoft.Insights

Description

Autoscale scale up completed

Microsoft.Insights/AutoscaleSettings/Write

Namespace: Microsoft.Insights

Description

Create or update an autoscale setting

Microsoft.Insights/Components/AnalyticsItems/Delete

Namespace: Microsoft.Insights

Description

Deleting an Application Insights analytics item

Microsoft.Insights/Components/AnalyticsItems/Write

Namespace: Microsoft.Insights

Description

Writing an Application Insights analytics item

Microsoft.Insights/Components/AnalyticsTables/Action

Namespace: Microsoft.Insights

Description

Application Insights analytics table action

Microsoft.Insights/Components/AnalyticsTables/Delete

Namespace: Microsoft.Insights

Description

Deleting an Application Insights analytics table schema

Microsoft.Insights/Components/AnalyticsTables/Write

Namespace: Microsoft.Insights

Description

Writing an Application Insights analytics table schema

Microsoft.Insights/Components/Annotations/Delete

Namespace: Microsoft.Insights

Description

Deleting an Application Insights annotation

Microsoft.Insights/Components/Annotations/Write

Namespace: Microsoft.Insights

Description

Writing an Application Insights annotation

Microsoft.Insights/Components/ApiKeys/Action

Namespace: Microsoft.Insights

Description

Generating an Application Insights API key

Microsoft.Insights/Components/ApiKeys/Delete

Namespace: Microsoft.Insights

Description

Deleting an Application Insights API key

Microsoft.Insights/Components/CurrentBillingFeatures/Write

Namespace: Microsoft.Insights

Description

Writing current billing features for Application Insights component

Microsoft.Insights/Components/DailyCapReached/Action

Namespace: Microsoft.Insights

Description

Reached the daily cap for Application Insights component

Microsoft.Insights/Components/DailyCapWarningThresholdReached/Action

Namespace: Microsoft.Insights

Description

Reached the daily cap warning threshold for Application Insights component

Microsoft.Insights/Components/Delete

Namespace: Microsoft.Insights

Description

Deleting an application insights component configuration

Example Resource Log Record #

{
  "ActivityStatusValue": "Success",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/components/dwhc6a93dappinsights",
    "action": "Microsoft.Insights/components/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/components/dwhc6a93dappinsights",
    "action": "Microsoft.Insights/components/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "CorrelationId": "c7ffb16b-7e03-405f-811b-5d1b43c880f1",
  "EventDataId": "58a10880-1899-b537-e31a-27f1253b20a2",
  "EventSubmissionTimestamp": "2026-07-03T02:26:12.9041359Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationNameValue": "MICROSOFT.INSIGHTS/COMPONENTS/DELETE",
  "Properties": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Insights/components/dwhc6a93dappinsights",
    "message": "Microsoft.Insights/components/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "58a10880-1899-b537-e31a-27f1253b20a2",
    "eventSubmissionTimestamp": "2026-07-03T02:26:12.9041359Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93dappinsights",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Insights/components/dwhc6a93dappinsights",
    "message": "Microsoft.Insights/components/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "58a10880-1899-b537-e31a-27f1253b20a2",
    "eventSubmissionTimestamp": "2026-07-03T02:26:12.9041359Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93dappinsights",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.INSIGHTS",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Microsoft.Insights/Components/ExportConfiguration/Action

Namespace: Microsoft.Insights

Description

Application Insights export settings action

Microsoft.Insights/Components/ExportConfiguration/Delete

Namespace: Microsoft.Insights

Description

Deleting Application Insights export settings

Microsoft.Insights/Components/ExportConfiguration/Write

Namespace: Microsoft.Insights

Description

Writing Application Insights export settings

Microsoft.Insights/Components/Favorites/Delete

Namespace: Microsoft.Insights

Description

Deleting an Application Insights favorite

Microsoft.Insights/Components/Favorites/Write

Namespace: Microsoft.Insights

Description

Writing an Application Insights favorite

Microsoft.Insights/Components/linkedStorageAccounts/Write

Namespace: Microsoft.Insights

Description

Create or modify linked storage account

Microsoft.Insights/Components/Move/Action

Namespace: Microsoft.Insights

Description

Move an Application Insights Component to another resource group or subscription

Microsoft.Insights/Components/MyAnalyticsItems/Delete

Namespace: Microsoft.Insights

Description

Deleting an Application Insights personal analytics item

Microsoft.Insights/Components/MyAnalyticsItems/Write

Namespace: Microsoft.Insights

Description

Writing an Application Insights personal analytics item

Microsoft.Insights/Components/PricingPlans/Write

Namespace: Microsoft.Insights

Description

Writing an Application Insights component pricing plan

Microsoft.Insights/Components/ProactiveDetectionConfigs/Write

Namespace: Microsoft.Insights

Description

Writing Application Insights proactive detection configuration

Microsoft.Insights/Components/providers/Microsoft.Insights/diagnosticSettings/Write

Namespace: Microsoft.Insights

Description

Create or update a resource diagnostic setting

Microsoft.Insights/Components/Purge/Action

Namespace: Microsoft.Insights

Description

Purging data from Application Insights

Microsoft.Insights/Components/WorkItemConfigs/Delete

Namespace: Microsoft.Insights

Description

Deleting an Application Insights ALM integration configuration

Microsoft.Insights/Components/WorkItemConfigs/Write

Namespace: Microsoft.Insights

Description

Writing an Application Insights ALM integration configuration

Microsoft.Insights/Components/Write

Namespace: Microsoft.Insights

Description

Writing to an application insights component configuration

Example Resource Log Record #

{
  "ActivityStatusValue": "Success",
  "ActivitySubstatusValue": "OK",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/components/dwhc6a93dappinsights",
    "action": "Microsoft.Insights/components/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/components/dwhc6a93dappinsights",
    "action": "Microsoft.Insights/components/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783059369",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282",
    "correlationid": "8b954797-dd76-4f9e-a599-9313c9f4beeb"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783059369",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282",
    "correlationid": "8b954797-dd76-4f9e-a599-9313c9f4beeb"
  },
  "CorrelationId": "8b954797-dd76-4f9e-a599-9313c9f4beeb",
  "EventDataId": "e34e64cc-7f04-95f1-92f2-635c460f8355",
  "EventSubmissionTimestamp": "2026-07-03T02:16:10.9068058Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationNameValue": "MICROSOFT.INSIGHTS/COMPONENTS/WRITE",
  "Properties": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/components/dwhc6a93dappinsights",
    "message": "Microsoft.Insights/components/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "e34e64cc-7f04-95f1-92f2-635c460f8355",
    "eventSubmissionTimestamp": "2026-07-03T02:16:10.9068058Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93dappinsights",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "Properties_d": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/components/dwhc6a93dappinsights",
    "message": "Microsoft.Insights/components/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "e34e64cc-7f04-95f1-92f2-635c460f8355",
    "eventSubmissionTimestamp": "2026-07-03T02:16:10.9068058Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93dappinsights",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.INSIGHTS",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Microsoft.Insights/CreateNotifications/Write

Namespace: Microsoft.Insights

Description

Send test notifications to the provided receiver list

Microsoft.Insights/DataCollectionEndpoints/Delete

Namespace: Microsoft.Insights

Description

Delete a data collection endpoint

Example Resource Log Record #

{
  "ActivityStatusValue": "Success",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/dataCollectionEndpoints/dwhc6a93ddcendpoint",
    "action": "Microsoft.Insights/dataCollectionEndpoints/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/dataCollectionEndpoints/dwhc6a93ddcendpoint",
    "action": "Microsoft.Insights/dataCollectionEndpoints/delete",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783045937",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282"
  },
  "CorrelationId": "89a2a8a6-f3d1-4ef8-a7ae-9be55d31329a",
  "EventDataId": "72ab3977-13b3-5d84-14a8-61b602bc7e0a",
  "EventSubmissionTimestamp": "2026-07-03T02:26:07.9372506Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationNameValue": "MICROSOFT.INSIGHTS/DATACOLLECTIONENDPOINTS/DELETE",
  "Properties": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Insights/dataCollectionEndpoints/dwhc6a93ddcendpoint",
    "message": "Microsoft.Insights/dataCollectionEndpoints/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "72ab3977-13b3-5d84-14a8-61b602bc7e0a",
    "eventSubmissionTimestamp": "2026-07-03T02:26:07.9372506Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93ddcendpoint",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourcegroups/rg-logcapture-gen/providers/Microsoft.Insights/dataCollectionEndpoints/dwhc6a93ddcendpoint",
    "message": "Microsoft.Insights/dataCollectionEndpoints/delete",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "72ab3977-13b3-5d84-14a8-61b602bc7e0a",
    "eventSubmissionTimestamp": "2026-07-03T02:26:07.9372506Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93ddcendpoint",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success"
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.INSIGHTS",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Microsoft.Insights/DataCollectionEndpoints/NetworkSecurityPerimeterAssociationProxies/Delete

Namespace: Microsoft.Insights

Description

Delete a data collection endpoint NSP association proxy

Microsoft.Insights/DataCollectionEndpoints/NetworkSecurityPerimeterAssociationProxies/Write

Namespace: Microsoft.Insights

Description

Create or update a data collection endpoint NSP association proxy

Microsoft.Insights/DataCollectionEndpoints/NetworkSecurityPerimeterConfigurations/Reconcile/Action

Namespace: Microsoft.Insights

Description

Reconcile data collection endpoint NSP configuration

Microsoft.Insights/DataCollectionEndpoints/ScopedPrivateLinkProxies/Delete

Namespace: Microsoft.Insights

Description

Delete a data collection endpoint private link proxy

Microsoft.Insights/DataCollectionEndpoints/ScopedPrivateLinkProxies/Write

Namespace: Microsoft.Insights

Description

Create or update a data collection endpoint private link proxy

Microsoft.Insights/DataCollectionEndpoints/TriggerFailback/Action

Namespace: Microsoft.Insights

Description

Trigger failback on a data collection endpoint

Microsoft.Insights/DataCollectionEndpoints/TriggerFailover/Action

Namespace: Microsoft.Insights

Description

Trigger failover on a data collection endpoint

Microsoft.Insights/DataCollectionEndpoints/Write

Namespace: Microsoft.Insights

Description

Create or update a data collection endpoint

Example Resource Log Record #

{
  "ActivityStatusValue": "Success",
  "ActivitySubstatusValue": "OK",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/dataCollectionEndpoints/dwhc6a93ddcendpoint",
    "action": "Microsoft.Insights/dataCollectionEndpoints/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/dataCollectionEndpoints/dwhc6a93ddcendpoint",
    "action": "Microsoft.Insights/dataCollectionEndpoints/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783059363",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282",
    "correlationid": "0088c8b5-cc1c-4c1b-871e-f9524f329182"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1783041418",
    "nbf": "1783041418",
    "exp": "1783059363",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "AXQAi/8cAAAAFIBIEdHXWN3pylNjmPLeQhWfcQ14ANLMkCfF9E8NqZtiUHdHNiO4QKChB+m3872z7F73QjwZK8qIldMrqscbefkaL+FBLWCt9JK9djz/ONZSfAxBzNSQV2uzP3xMJVD4RnM7NXOM1v57WDtsGbmO1g==",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "1111111111111111",
    "rh": "1.AXgA2MxkHpDbsUq-nMBN5yQeykZIf3kAutdPukPawfj2MBMBAM54AA.",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "tUdFU6nO4UmtUjpbHDqEAA",
    "ver": "1.0",
    "wids": "62e90394-69f5-4237-9190-012177145e10,b79fbf4d-3ef9-4689-8143-76b194e85509",
    "xms_act_fct": "3 5",
    "xms_ftd": "Jy-cEgg_SioO6K76SbtPp6tIHeVnjtpmAf1GT_VpKMsBdXNzb3V0aC1kc21z",
    "xms_idrel": "1 6",
    "xms_sub_fct": "3 4",
    "xms_tcdt": "1768616282",
    "correlationid": "0088c8b5-cc1c-4c1b-871e-f9524f329182"
  },
  "CorrelationId": "0088c8b5-cc1c-4c1b-871e-f9524f329182",
  "EventDataId": "6def0f04-addb-deaf-a9c1-86c8429218f5",
  "EventSubmissionTimestamp": "2026-07-03T02:16:05.1121772Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Information",
  "OperationNameValue": "MICROSOFT.INSIGHTS/DATACOLLECTIONENDPOINTS/WRITE",
  "Properties": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/dataCollectionEndpoints/dwhc6a93ddcendpoint",
    "message": "Microsoft.Insights/dataCollectionEndpoints/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "6def0f04-addb-deaf-a9c1-86c8429218f5",
    "eventSubmissionTimestamp": "2026-07-03T02:16:05.1121772Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93ddcendpoint",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "Properties_d": {
    "statusCode": "OK",
    "serviceRequestId": "",
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/resourceGroups/rg-logcapture-gen/providers/Microsoft.Insights/dataCollectionEndpoints/dwhc6a93ddcendpoint",
    "message": "Microsoft.Insights/dataCollectionEndpoints/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "6def0f04-addb-deaf-a9c1-86c8429218f5",
    "eventSubmissionTimestamp": "2026-07-03T02:16:05.1121772Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "dwhc6a93ddcendpoint",
    "resourceGroup": "rg-logcapture-gen",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Success",
    "activitySubstatusValue": "OK"
  },
  "ResourceGroup": "rg-logcapture-gen",
  "ResourceProviderValue": "MICROSOFT.INSIGHTS",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222"
}

Microsoft.Insights/DataCollectionRuleAssociations/Delete

Namespace: Microsoft.Insights

Description

Delete a resource's association with a data collection rule

Microsoft.Insights/DataCollectionRuleAssociations/Write

Namespace: Microsoft.Insights

Description

Create or update a resource's association with a data collection rule

Microsoft.Insights/DataCollectionRules/Delete

Namespace: Microsoft.Insights

Description

Delete a data collection rule

Microsoft.Insights/DataCollectionRules/Write

Namespace: Microsoft.Insights

Description

Create or update a data collection rule

Microsoft.Insights/DiagnosticSettings/Delete

Namespace: Microsoft.Insights

Description

Delete a resource diagnostic setting

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

Azure Diagnostic Settings Deleted source medium: Identifies the deletion of diagnostic settings in Azure, which send platform logs and metrics to different destinations. An adversary may delete diagnostic settings in an attempt to evade defenses.T1562, T1562.001, T1562.008

Kusto #

Azure Diagnostic settings removed from a resource source medium: This query looks for diagnostic settings that are removed from a resource. This could indicate an attacker or malicious internal trying to evade detection before malicious act is performed. If the diagnostic settings are being deleted as part of a parent resource deletion, the event is ignores.T1562, T1562.008

Panther #

Azure Diagnostic Settings Deleted source medium: Detects when Azure diagnostic settings are deleted. Deleting diagnostic settings disables logging and monitoring, which is a common technique to hide malicious activity.T1562.008

Microsoft.Insights/DiagnosticSettings/Write

Namespace: Microsoft.Insights

Description

Create or update a resource diagnostic setting

Example Resource Log Record #

{
  "ActivityStatus": "",
  "ActivityStatusValue": "Failure",
  "ActivitySubstatus": "",
  "ActivitySubstatusValue": "Conflict",
  "Authorization": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/microsoft.insights/diagnosticSettings/ds-activity-law",
    "action": "microsoft.insights/diagnosticSettings/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Authorization_d": {
    "scope": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/microsoft.insights/diagnosticSettings/ds-activity-law",
    "action": "microsoft.insights/diagnosticSettings/write",
    "evidence": {
      "role": "Owner",
      "roleAssignmentScope": "/subscriptions/22222222-2222-2222-2222-222222222222",
      "roleAssignmentId": "0614d5b6f6da4638b65970d8138290c0",
      "roleDefinitionId": "8e3af657a8ff443ca75c2fe8c4bcb635",
      "principalId": "aaaaaaaa000000000000000000000001",
      "principalType": "User"
    }
  },
  "Caller": "adminuser@example.onmicrosoft.com",
  "CallerIpAddress": "203.0.113.10",
  "Category": "",
  "CategoryValue": "Administrative",
  "Claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "aio": "REDACTED",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "idtyp": "user",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "puid": "REDACTED",
    "rh": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282"
  },
  "Claims_d": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/11111111-1111-1111-1111-111111111111/",
    "iat": "1782752670",
    "nbf": "1782752670",
    "exp": "1782756583",
    "aio": "REDACTED",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "appidacr": "0",
    "idtyp": "user",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "aaaaaaaa-0000-0000-0000-000000000001",
    "rh": "REDACTED",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "59zMO99J0dkUCRNy4Ijj09ztqIlC6EL2p5Qt9PVxzvM",
    "http://schemas.microsoft.com/identity/claims/tenantid": "11111111-1111-1111-1111-111111111111",
    "uti": "REDACTED",
    "ver": "1.0",
    "wids": "REDACTED",
    "xms_act_fct": "3 5",
    "xms_ftd": "Qm3VI9ndhO4eGa9PlO2ooXp_lItcoAEfvdN1STz6NOIBdXNlYXN0LWRzbXM",
    "xms_idrel": "1 2",
    "xms_sub_fct": "2 3",
    "xms_tcdt": "1768616282",
    "groups": "7e349a88-0f5b-4e6e-b331-4ecd314e4e20",
    "http://schemas.microsoft.com/claims/authnclassreference": "1",
    "acrs": "p1",
    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "User",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Admin",
    "ipaddr": "203.0.113.10",
    "name": "Admin User",
    "puid": "REDACTED",
    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
    "sid": "0022840a-e4ab-884c-587f-d20d24637227",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "adminuser@example.onmicrosoft.com",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "adminuser@example.onmicrosoft.com"
  },
  "CorrelationId": "36cd279a-8b0f-4968-a146-f0d5139a9aa0",
  "EventDataId": "3785540e-1413-da5a-18f2-6fed02440c71",
  "EventSubmissionTimestamp": "2026-06-29T17:17:35.9549633Z",
  "HTTPRequest": {
    "clientIpAddress": "203.0.113.10"
  },
  "Hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
  "Level": "Error",
  "OperationId": "",
  "OperationName": "",
  "OperationNameValue": "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE",
  "Properties": {
    "statusCode": "Conflict",
    "serviceRequestId": "",
    "statusMessage": {
      "code": "InvalidAuthenticationToken",
      "message": "Please register the subscription '22222222-2222-2222-2222-222222222222' with Microsoft.Insights."
    },
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/microsoft.insights/diagnosticSettings/ds-activity-law",
    "message": "microsoft.insights/diagnosticSettings/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "3785540e-1413-da5a-18f2-6fed02440c71",
    "eventSubmissionTimestamp": "2026-06-29T17:17:35.9549633Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "ds-activity-law",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Failure",
    "activitySubstatusValue": "Conflict"
  },
  "Properties_d": {
    "eventCategory": "Administrative",
    "entity": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/microsoft.insights/diagnosticSettings/ds-activity-law",
    "message": "microsoft.insights/diagnosticSettings/write",
    "hierarchy": "11111111-1111-1111-1111-111111111111/22222222-2222-2222-2222-222222222222",
    "caller": "adminuser@example.onmicrosoft.com",
    "eventDataId": "3785540e-1413-da5a-18f2-6fed02440c71",
    "eventSubmissionTimestamp": "2026-06-29T17:17:35.9549633Z",
    "httpRequest": {
      "clientIpAddress": "203.0.113.10"
    },
    "resource": "ds-activity-law",
    "resourceProviderValue": "MICROSOFT.INSIGHTS",
    "subscriptionId": "22222222-2222-2222-2222-222222222222",
    "activityStatusValue": "Failure",
    "statusCode": "Conflict",
    "serviceRequestId": "",
    "activitySubstatusValue": "Conflict",
    "statusMessage": {
      "code": "InvalidAuthenticationToken",
      "message": "Please register the subscription '22222222-2222-2222-2222-222222222222' with Microsoft.Insights."
    }
  },
  "Resource": "",
  "ResourceGroup": "",
  "ResourceId": "",
  "ResourceProvider": "",
  "ResourceProviderValue": "MICROSOFT.INSIGHTS",
  "SourceSystem": "Azure",
  "SubscriptionId": "22222222-2222-2222-2222-222222222222",
  "TenantId": "00000000-0000-0000-0000-000000000000",
  "TimeGenerated": "2026-06-29T17:17:35.9549633Z",
  "Type": "AzureActivity",
  "_ResourceId": "/subscriptions/22222222-2222-2222-2222-222222222222/providers/microsoft.insights/diagnosticsettings/ds-activity-law"
}

Microsoft.Insights/ExtendedDiagnosticSettings/Delete

Namespace: Microsoft.Insights

Description

Delete a network flow log diagnostic setting

Microsoft.Insights/ExtendedDiagnosticSettings/Write

Namespace: Microsoft.Insights

Description

Create or update a network flow log diagnostic setting

Microsoft.Insights/ListMigrationDate/Action

Namespace: Microsoft.Insights

Description

Get back Subscription migration date

Microsoft.Insights/LogProfiles/Delete

Namespace: Microsoft.Insights

Description

Delete an Activity Log log profile

Microsoft.Insights/LogProfiles/Write

Namespace: Microsoft.Insights

Description

Create or update an Activity Log log profile

Microsoft.Insights/MetricAlerts/Delete

Namespace: Microsoft.Insights

Description

Delete a metric alert

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`resultType` (panther rule field)	in	`Succeeded`	1 rule	panther
`resultType` (panther rule field)	in	`Success`	1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

Azure Alert Rules Deleted source medium: Detects when Azure alert rules are deleted. Deleting alert rules disables security notifications and is a common defense evasion technique.T1562.008↳ also matches Microsoft.Insights/AlertRules/Delete

Microsoft.Insights/MetricAlerts/Write

Namespace: Microsoft.Insights

Description

Create or update a metric alert

Microsoft.Insights/Metrics/Action

Namespace: Microsoft.Insights

Description

Metric Action

Microsoft.Insights/MigrateToNewpricingModel/Action

Namespace: Microsoft.Insights

Description

Migrate subscription to new pricing model

Microsoft.Insights/MonitoredObjects/Delete

Namespace: Microsoft.Insights

Description

Delete a monitored object

Microsoft.Insights/MonitoredObjects/Write

Namespace: Microsoft.Insights

Description

Create or update a monitored object

Microsoft.Insights/PrivateLinkScopes/Delete

Namespace: Microsoft.Insights

Description

Delete a private link scope

Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnectionProxies/Delete

Namespace: Microsoft.Insights

Description

Delete a private endpoint connection proxy

Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnectionProxies/Validate/Action

Namespace: Microsoft.Insights

Description

Validate a private endpoint connection proxy

Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnectionProxies/Write

Namespace: Microsoft.Insights

Description

Create or update a private endpoint connection proxy

Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnections/Delete

Namespace: Microsoft.Insights

Description

Delete a private endpoint connection

Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnections/Write

Namespace: Microsoft.Insights

Description

Create or update a private endpoint connection

Microsoft.Insights/PrivateLinkScopes/PrivateEndpointConnectionsApproval/action

Namespace: Microsoft.Insights

Description

Approve or reject a connection to a Private Endpoint resource of Microsoft.Network provider

Microsoft.Insights/PrivateLinkScopes/ScopedResources/Delete

Namespace: Microsoft.Insights

Description

Delete a private link scoped resource

Microsoft.Insights/PrivateLinkScopes/ScopedResources/Write

Namespace: Microsoft.Insights

Description

Create or update a private link scoped resource

Microsoft.Insights/PrivateLinkScopes/Write

Namespace: Microsoft.Insights

Description

Create or update a private link scope

Microsoft.Insights/Register/Action

Namespace: Microsoft.Insights

Description

Microsoft.Insights/RollbackToLegacyPricingModel/Action

Namespace: Microsoft.Insights

Description

Rollback subscription to legacy pricing model

Microsoft.Insights/ScheduledQueryRules/Delete

Namespace: Microsoft.Insights

Description

Deleting a scheduled query rule

Microsoft.Insights/ScheduledQueryRules/NetworkSecurityPerimeterAssociationProxies/Delete

Namespace: Microsoft.Insights

Description

Deleting a network security perimeter association proxy for scheduled query rules

Microsoft.Insights/ScheduledQueryRules/NetworkSecurityPerimeterAssociationProxies/Write

Namespace: Microsoft.Insights

Description

Writing a network security perimeter association proxy for scheduled query rules

Microsoft.Insights/ScheduledQueryRules/networkSecurityPerimeterConfigurations/Reconcile/Action

Namespace: Microsoft.Insights

Description

Reconciling network security perimeter configuration for scheduled query rules

Microsoft.Insights/ScheduledQueryRules/Write

Namespace: Microsoft.Insights

Description

Writing a scheduled query rule

Microsoft.Insights/TenantActionGroups/Delete

Namespace: Microsoft.Insights

Description

Delete a tenant action group

Microsoft.Insights/TenantActionGroups/Write

Namespace: Microsoft.Insights

Description

Create or update a tenant action group

Microsoft.Insights/Tenants/Register/Action

Namespace: Microsoft.Insights

Description

Initializes the Microsoft Insights provider

Microsoft.Insights/Unregister/Action

Namespace: Microsoft.Insights

Description

Microsoft.Insights/Webtests/Delete

Namespace: Microsoft.Insights

Description

Deleting a webtest configuration

Microsoft.Insights/Webtests/Write

Namespace: Microsoft.Insights

Description

Writing to a webtest configuration

Microsoft.Insights/Workbooks/Delete

Namespace: Microsoft.Insights

Description

Delete a workbook

Microsoft.Insights/Workbooks/Write

Namespace: Microsoft.Insights

Description

Create or update a workbook

Microsoft.Insights/WorkbookTemplates/Delete

Namespace: Microsoft.Insights

Description

Delete a workbook template

Microsoft.Insights/WorkbookTemplates/Write

Namespace: Microsoft.Insights

Description

Create or update a workbook template

Azure Monitor Azure-Microsoft.Insights

any: Azure Monitor (catch-all)

Description

Microsoft.Insights/ActionGroups/Delete

Description

Example Resource Log Record #

Common Indicators #

Detection Rules #

Panther #

Microsoft.Insights/actionGroups/NetworkSecurityPerimeterAssociationProxies/Delete

Description

Microsoft.Insights/actionGroups/NetworkSecurityPerimeterAssociationProxies/Write

Description

Microsoft.Insights/actionGroups/NetworkSecurityPerimeterConfigurations/Reconcile/Action

Description

Microsoft.Insights/ActionGroups/Write

Description

Example Resource Log Record #

Microsoft.Insights/ActivityLogAlerts/Activated/Action

Description

Example Resource Log Record #

Microsoft.Insights/ActivityLogAlerts/Delete

Description

Example Resource Log Record #

Microsoft.Insights/ActivityLogAlerts/Write

Description

Example Resource Log Record #

Microsoft.Insights/AlertRules/Activated/Action

Description

Microsoft.Insights/AlertRules/Delete

Description

Common Indicators #

Related events #

Detection Rules #

Panther #

Microsoft.Insights/AlertRules/Resolved/Action

Description

Microsoft.Insights/AlertRules/Throttled/Action

Description

Microsoft.Insights/AlertRules/Write

Description

Microsoft.Insights/AutoscaleSettings/Delete

Description

Microsoft.Insights/AutoscaleSettings/PredictiveScaleup/Action

Description

Microsoft.Insights/AutoscaleSettings/PredictiveScaleupResult/Action

Description

Microsoft.Insights/AutoscaleSettings/providers/Microsoft.Insights/diagnosticSettings/Write

Description

Microsoft.Insights/AutoscaleSettings/Scaledown/Action

Description

Microsoft.Insights/AutoscaleSettings/ScaledownResult/Action

Description

Microsoft.Insights/AutoscaleSettings/Scaleup/Action

Description

Microsoft.Insights/AutoscaleSettings/ScaleupResult/Action

Description

Microsoft.Insights/AutoscaleSettings/Write

Description

Microsoft.Insights/Components/AnalyticsItems/Delete

Description

Microsoft.Insights/Components/AnalyticsItems/Write

Description

Microsoft.Insights/Components/AnalyticsTables/Action

Description

Microsoft.Insights/Components/AnalyticsTables/Delete

Description

Microsoft.Insights/Components/AnalyticsTables/Write

Description

Microsoft.Insights/Components/Annotations/Delete

Description

Microsoft.Insights/Components/Annotations/Write

Description

Microsoft.Insights/Components/ApiKeys/Action

Description

Microsoft.Insights/Components/ApiKeys/Delete

Description

Microsoft.Insights/Components/CurrentBillingFeatures/Write

Description

Microsoft.Insights/Components/DailyCapReached/Action