Description:

This control ensures an Activity Log Alert is configured to notify when a Public IP address is deleted in Azure. Since Public IPs enable inbound access, unauthorized or accidental deletion may cause outages or misconfiguration. The alert provides real-time visibility, enabling administrators to quickly investigate and remediate issues.


Rationale:

Public IP deletion can disrupt operations and may indicate unauthorized or unplanned changes. Without alerting, issues may go unnoticed, causing downtime or misconfigurations. Enabling alerts ensures timely detection, investigation, and improved security governance over critical network configuration changes.


Impact:

Enabling this alert may slightly increase security notifications in active environments but has no performance impact and greatly improves early detection of risky changes.


Pre-requisites:

  • Azure subscription access with Owner, Contributor, or Monitoring Contributor role

  • Azure Monitor enabled

  • At least one Action Group configured (email, SMS, webhook, ITSM, or SIEM integration)

  • Permissions to create and manage alert rules


Test Plan:

  1. Sign in to the Azure Portal at https://portal.azure.com

  2. Navigate to Monitor

  3. Select Alerts

  4. Open Alert rules

  5. Verify an Activity Log Alert exists for Delete Public IP Address

  6. Verify the alert scope includes the required subscription

  7. Verify that an Action Group is associated

  8. If the alert does not exist, follow the implementation steps


Implementation  Steps:

  1. Sign in to the Azure Portal at https://portal.azure.com

  2. Navigate to Monitor

  3. Select Alerts

  4. Click Create and select Alert rule



  1. Set the Scope to the appropriate subscription

  2. Under Condition, click See all signals, search for Delete Public IP Address, and select the signal



  1. Associate with an existing Action Group or create a new one

  2. Provide an alert rule name and select a resource group



  1. Click Review + Create

  2. Click Create


Backout Plan:

  1. Sign in to the Azure Portal at https://portal.azure.com

  2. Navigate to Monitor

  3. Select Alerts

  4. Open Alert rules

  5. Locate the Delete Public IP Address alert

  6. Delete the alert rule

  7. Confirm the deletion


References:

  1. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log

  2. https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-activity-log

  3. https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview

  4.  https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups

  5. https://learn.microsoft.com/en-us/azure/templates/microsoft.network/publicipaddresses

  6. https://learn.microsoft.com/en-us/azure/role-based-access-control/overview

  7. https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/manage/monitor-best-practices