Receiving a bad request - The application could not be found error when creating a Monitor Scheduled Query Rule via Terraform

Question

Receiving a bad request - The application could not be found error when creating a Monitor Scheduled Query Rule via Terraform

Garrick Hensberg 0

Hi All,

I am using Terraform to deploy my Azure resources. I have recently started receiving an error when deploying resources using azurerm_monitor_scheduled_query_rules_alert_v2.

I am getting the following error:

Error: creating or updating Monitor Scheduled Query Rule (Subscription: ""*

│ Resource Group Name: "xxx"

│ Scheduled Query Rule Name: "xxx-alert"): unexpected status 400 (400 Bad Request) with error: BadRequest: The application could not be found Activity ID: 4fcf2337-57c0-4228-9e89-c239bce70368.

This began happening on Friday (7th March) but was working fine the day before. Nothing has changed with this terraform resource configuration.

I used the same terraform configuration in another subscription and that subscription worked correctly and the alert was created.

I assume something is wrong with the subscription that I am getting this error on, but I have no idea what to look for to resolve the issue.

Any help in this regard would be very much appreciated.

Terraform used to create the resource:

`

resource "azurerm_monitor_scheduled_query_rules_alert_v2" "default" {
  name                = "xxx-alert"
  location            = var.region
  resource_group_name = var.resource_group_name

  action {
    action_groups = var.action_groups
  }

  scopes      = [var.data_source_id]
  description = var.description
  enabled     = var.enabled
  criteria {
    query                   = var.query
    operator                = var.operator
    threshold               = var.threshold
    time_aggregation_method = "Count"
  }
  severity             = var.severity
  evaluation_frequency = var.frequency
  window_duration      = var.time_window
}

`

1 answer

Your answer

Answer 1

Boris Von Dahle 3,211

Hello,

The error that you receive : BadRequest: The application could not be found Activity ID: 4fcf2337-57c0-4228-9e89-c239bce70368. is likely to be due to incorrect permissions or inexistant application.

Try to see if your app still exist or has the right privileges :

az ad sp show --id <your-client-id>

Regards

Boris von Dahle

Garrick Hensberg 0 Reputation points

2025-03-09T20:44:44.8633333+00:00

Hi Boris,

Thanks for the suggestion.

The service principal that the terraform is running under does still exist and has permissions to create the alerts.

This same service principal was able to create all my other Azure resources, just not this one.

As a note, I could create a query alert against another resource (scope), but this has failed when using the application insights resource as the scope for the query alert.

I can also confirm that the application insights resource does exist at the time of creating the query rule alert.
Vinod Pittala 735 Reputation points Microsoft External Staff

2025-03-10T03:01:38.35+00:00

Hello Garrick Hensberg,

Error: creating or updating Monitor Scheduled Query Rule (Subscription: ""* │ Resource Group Name: "xxx" │ Scheduled Query Rule Name: "xxx-alert"): unexpected status 400 (400 Bad Request) with error: BadRequest: The application could not be found Activity ID: 4fcf2337-57c0-4228-9e89-c239bce70368.

Firstly, as per the above error message, please be ensured that the Application Insights resource you're targeting with the alert exists and is available in the subscription where you're deploying the alert. i.e. Application Insights resource is correctly configured and accessible. Try querying it directly using the Azure portal to ensure it's responding as expected.

And double-check the permissions for the service principal you're using. and ensure it has sufficient permissions. Specifically, it should have the necessary Monitoring Contributor role assigned at the appropriate scope.

Ensure that the var.data_source_id variable, which represents the scope of your alert, contains the correct and fully qualified resource ID for the Application Insights resource.

As you mentioned that the alert works with other resources, try setting the scope to a different resource within the same subscription to see if it succeeds. and please post the evidential screenshot for the same. This could help us determine if the issue is specific to the Application Insights resource.

If the comment helpful, please click Upvote it.

Thanks
Garrick Hensberg 0 Reputation points

2025-03-10T04:28:18.9+00:00

Hi Vinod,

I can verify that the application insights resource is available and I can perform the desired query on the resource directly through the Azure Portal.

The permissions are correct for the service principal account that I am using.

I did try to create an alert against a different resource, but my service principal doesn't have permissions to another resource that I can test his on.

The process I have on my side is to destroy certain resources everyday and recreate them then on a daily basis.

What I just tried to do now was create the exact same alert with all the same configuration except I just change the name of the alert and now it worked. I just added a "-2" into the name.

So I know my permissions are correct.

If I use the old alert name, it doesn't work and I get the error as above.

And as I stated above, I am running the exact same configuration in another subscription and that one is working as expected without having to change any alert names.

Not sure if that helps identify the issue any further.
Garrick Hensberg 0 Reputation points

2025-03-10T04:34:02.08+00:00

I also created another alert with a completely different name and that has also worked.
Garrick Hensberg 0 Reputation points

2025-03-10T05:34:07.5666667+00:00

So I deleted those alert resources again and tried recreating them. I am now getting the same error on one of the alerts that had just been destroyed.
There seems to be some issue using the same name for the alert when recreating the resource.
Vinod Pittala 735 Reputation points Microsoft External Staff

2025-03-10T06:06:17.6833333+00:00
Hello Garrick Hensberg,

Thank you for providing the clarification.

This began happening on Friday (7th March) but was working fine the day before. Nothing has changed with this terraform resource configuration.

It seems that the issue began on Friday, March 7th, although everything was functioning correctly the day before. Importantly, there have been no changes to the Terraform resource configuration.

Reflecting on your initial observations, I understand that you were previously able to create an alert without any issues. However, you are now encountering an error related to the alert name ("xxx-alert").

You've mentioned that changing the alert rule name allows you to successfully create a new alert within the current subscription. Interestingly, you are able to use the original alert name in other subscriptions without any problems. This suggests the possibility that an alert rule with the name "xxx-alert" might still exist in the current resource group.

To address this, I recommend checking for any existing alert rules with the same name in the current resource group. If you locate an alert rule with the name "xxx-alert," please delete it and attempt to create a new one using the same configuration.

Here are the steps to identify any hidden alert rules within the resource group:

Go to the Azure portal.

Navigate to your target Resource Group.

Click on "Overview" and search for "Alerts."

Ensure that you enable the "Show hidden types" option.

If you find an alert rule with the same name, please proceed to delete it.

I hope this resolves the issue. Please feel free to reach out if you have any further questions or require additional assistance. I'm here to help.

If this solution is helpful, please "Upvote" it, as it may benefit other community members.

Thank you.
Ashok Gandhi Kotnana 4,310 Reputation points Microsoft External Staff

2025-03-10T17:05:01.1633333+00:00

HI @Garrick Hensberg ,

Please ensure the subscription_id is explicitly provide in the provider block, as the terraform code might not fetch the correct subscription.

Let me know how it goes, if it didn't worked let me know let me provide more insights on this request

provider "azurerm" {

subscription_id = "subscription-id"

features {}

}

Thankyou
Garrick Hensberg 0 Reputation points

2025-03-10T19:25:19.1333333+00:00

Hi @Vinod Pittala ,

I have checked across all my resources in the subscription and there are no alerts already existing with that name.
Garrick Hensberg 0 Reputation points

2025-03-10T19:29:07.4333333+00:00

Hi @Ashok Gandhi Kotnana ,

I can verify that the correct subscription is being used.

The service principal account I am using for running Terraform has only has access to the single subscription.

Explicitly setting the subscription id did not work.
Madugula Jahnavi 0 Reputation points Microsoft External Staff

2025-03-11T15:28:37.2966667+00:00

Garrick Hensberg, Have you tried creating it from the Portal to check if it is working in that way? If it works, then we can check with the Terraform.
Madugula Jahnavi 0 Reputation points Microsoft External Staff

2025-03-11T16:45:45.07+00:00

Garrick Hensberg, Can you try creating a user assigned identity as shown in

TerraformRegistry for deployment!
Garrick Hensberg 0 Reputation points

2025-03-12T02:22:03.6933333+00:00

Hi @Madugula Jahnavi

I do not have personal access to the subscription that this is happening in. My only access is through Terraform. So I am unable to perform this action directly in the Portal.

Regarding the user assigned identity, I am able to create the security alert when using a different alert name than the original name that I have always used over the past few years. So I can only assume that permissions is not an issue here but instead the alert name that I am using for some reason.

Share via

Receiving a bad request - The application could not be found error when creating a Monitor Scheduled Query Rule via Terraform

1 answer

Your answer