# Ensure that Activity Log Alert exists for Delete Public IP Address rule .

- Source: https://support.icompaas.com/support/solutions/articles/62000229924-ensure-that-activity-log-alert-exists-for-delete-public-ip-address-rule
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-06-16
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This control ensures an Activity Log Alert is configured to notify when a Public IP address is deleted in Azure. Since Public IPs enable inbound access, unauthorized or accidental deletion may cause outages or misconfiguration. The alert provides real-time visibility, enabling administrators to quickly investigate and remediate issues.

  

Rationale:

Public IP deletion can disrupt operations and may indicate unauthorized or unplanned changes. Without alerting, issues may go unnoticed, causing downtime or misconfigurations. Enabling alerts ensures timely detection, investigation, and improved security governance over critical network configuration changes.

  

Impact:

Enabling this alert may slightly increase security notifications in active environments but has no performance impact and greatly improves early detection of risky changes.

  

Pre-requisites:

-   Azure subscription access with Owner, Contributor, or Monitoring Contributor role
    
-   Azure Monitor enabled
    
-   At least one Action Group configured (email, SMS, webhook, ITSM, or SIEM integration)
    
-   Permissions to create and manage alert rules
    

  

Test Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Navigate to Monitor
    
3.  Select Alerts
    
4.  Open Alert rules
    
5.  Verify an Activity Log Alert exists for Delete Public IP Address
    
6.  Verify the alert scope includes the required subscription
    
7.  Verify that an Action Group is associated
    
8.  If the alert does not exist, follow the implementation steps
    

  

Implementation  Steps:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Navigate to Monitor
    
3.  Select Alerts
    
4.  Click Create and select Alert rule
    

  

  

5.  Set the Scope to the appropriate subscription
    
6.  Under Condition, click See all signals, search for Delete Public IP Address, and select the signal
    

  

  

7.  Associate with an existing Action Group or create a new one
    
8.  Provide an alert rule name and select a resource group
    

  

  

9.  Click Review + Create
    
10.  Click Create
     

  

Backout Plan:

1.  Sign in to the Azure Portal at [https://portal.azure.com](https://portal.azure.com/)
    
2.  Navigate to Monitor
    
3.  Select Alerts
    
4.  Open Alert rules
    
5.  Locate the Delete Public IP Address alert
    
6.  Delete the alert rule
    
7.  Confirm the deletion
    

  

References:

1.  [https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log)
    
2.  [https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-activity-log](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-activity-log)
    
3.  [https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview)
    
4.   [https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups)
    
5.  [https://learn.microsoft.com/en-us/azure/templates/microsoft.network/publicipaddresses](https://learn.microsoft.com/en-us/azure/templates/microsoft.network/publicipaddresses)
    
6.  [https://learn.microsoft.com/en-us/azure/role-based-access-control/overview](https://learn.microsoft.com/en-us/azure/role-based-access-control/overview)
    
7.  [https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/manage/monitor-best-practices](https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/manage/monitor-best-practices)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.