Ensure that Activity Log Alert exists for Create or Update Public IP Address rule

Overview

Create an Activity Log Alert for the Create or Update Public IP Addresses event.

Rationale

Monitoring for Create or Update Public IP Addresses events gives insight into network access changes and may reduce the time it takes to detect suspicious activity.

Impact

There will be a substantial increase in log size if there are a large number of administrative actions on a server.

Remediation guidance

From Azure Console

Navigate to the Monitor blade.
Select Alerts.
Select Create.
Select Alert Rule.
Under Scope, click Select scope.
Select your subscription and click Apply.
Select the Condition tab.
Under Signal name, click Create or Update Public IP Address (Microsoft.Network/publicIPAddresses).
Select the Actions tab.
To use an existing action group, click Select action groups. To create a new action group, click Create action group. Fill out the appropriate details for the selection.
Select the Details tab.
Select a Resource Group, provide an Alert rule name and an optional Alert rule description.
Click Review + create.
Click Create.

Using Azure Command Line Interface

Use the below command to create an Activity Log Alert for Create or Update Public IP Address.

az monitor activity-log alert create --resource-group "<resourceGroupName" --condition category=Administrative and operationName=Microsoft.Network/publicIPAddresses/write and level=verbose --scope "/subscriptions/<subscriptionID>" --name "<activityLogRuleName>" --subscription <subscriptionID> --action-group <actionGroupID>

Using Azure Powershell

Create the conditions object.

$conditions = @() 
$conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Administrative -Field category 
$conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Microsoft.Network/publicIPAddresses/write -Field operationName 
$conditions += New-AzActivityLogAlertAlertRuleAnyOfOrLeafConditionObject -Equal Verbose -Field level

Get the Action Group information and store it in a variable, then create a new Action object.

$actionGroup = Get-AzActionGroup -ResourceGroupName <resourceGroupName> -Name <actionGroupName>
$actionObject = New-AzActivityLogAlertActionGroupObject -Id $actionGroup.Id

Create the scope variable.

$scope = "/subscriptions/<subscriptionID>"

Create the Activity Log Alert Rule for Microsoft.Network/publicIPAddresses/write.

New-AzActivityLogAlert -Name "<activityAlertRuleName>" -ResourceGroupName "<resourceGroupName>" -Condition $conditions -Scope $scope -Location global -Action $actionObject -Subscription “<subscriptionID>” -Enabled $true

Default Value

By default, no monitoring alerts are created.

References

Multiple Remediation Paths

Azure

SERVICE-WIDE (RECOMMENDED when many resources are affected): Assign Azure Policy initiatives at management group/subscription scope and trigger remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

ASSET-LEVEL: Apply the resource-specific remediation steps above to the listed non-compliant resources.

PREVENTIVE: Embed Azure Policy checks into landing zones and IaC workflows to block or auto-remediate drift.

References for Service-Wide Patterns

Azure Policy overview: https://learn.microsoft.com/en-us/azure/governance/policy/overview
Azure Policy remediation: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources
Azure Policy initiative structure: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

Azure: assign policy initiatives at management group/subscription scope and run remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

2. Remediate Existing Affected Assets

Execute the control-specific Console/CLI steps documented above for each flagged resource.
Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

Re-scan after each remediation batch.
Track exceptions with owner and expiry date.
Add preventive checks in IaC/CI pipelines.

Query logic

These are the stored checks tied to this control.

Activity Log Alert exists for Create or Update Public IP Address

Connectors

Microsoft Azure

Covered asset types

Connector

Expected check: eq []

query ($subscriptionResourceId: String!) {
  AzureActivityLogAlertsForAction(
    subscriptionResourceId: $subscriptionResourceId
    equals: "microsoft.network/publicIPAddresses/write") {
    ...AssetFragment
  }
}

Ensure that Activity Log Alert exists for Create or Update Public IP Address rule

Overview

Remediation guidance

Multiple Remediation Paths

Azure

References for Service-Wide Patterns

Operational Rollout Workflow

1. Contain at Service-Wide Scope First (Recommended)

2. Remediate Existing Affected Assets

3. Validate and Prevent Recurrence

Query logic

Platform

Use Cases

Industries

Compare

Resources

Company