Azure Monitor: Unable to Create Alerts for JIT Access Events with Security Category

Question

I am trying to create an alert to be generated when a VM JIT access request is made.

While creating the alert, when I choose the signal "Initiate JIT Network Access Policy (Just-In-Time Network Access Policies)" where the signal source is of type "Security", I am not able to see any events nor does the alert get triggerred when the JIT activity occurs.

I found that the alert Condition is "Whenever the Activity Log has an event with Category='Security', Signal name='Initiate JIT Network Access Policy'". Note that the category selected is "Security".

However, I have confirmed from the Activity Log in Azure Monitor that the event Category is actually "Administrative".

Choosing to create an alert from the Activity Log also gives an error about scope:

I am able to create the alert when using Log Analytics at an added cost, however I would like to know why the above does not work or what can be done to get the desired result.

Answer 1

Hi Emdad,

Thanks for reaching out to Microsoft Q&A.

From the images and your description, it appears that you are facing two main issues:

1. Alert based on "Initiate JIT Network Access Policy" Signal: You are attempting to set an alert based on the "Initiate JIT Network Access Policy" signal with the "Security" category, but the activity log shows that the event is categorized under "Administrative." As a result, the alert is not getting triggered since there is a mismatch between the alert condition and the actual event category. Why this happens:
   • Azure Monitor Activity Log events are categorized based on their nature. JIT (Just-In-Time) requests, while they might seem like security-related events, are typically administrative operations (related to VM access control) and hence fall under the "Administrative" category, not "Security."
   • The alert you are trying to configure is using the wrong event category (Security) for this type of event.
   Solution:
   • Change the alert's condition to use the Administrative category instead of Security, as per the actual category of the JIT request events in your Activity Log.
     • You can set the alert to trigger when the Activity Log has an event with Category='Administrative' and Signal name='Initiate JIT Network Access Policy'. This should ensure that the alert is properly triggered when a JIT request occurs.
2. Scope Error: You encountered an issue with scope selection, as seen in the error message stating, "Couldn't find the selected scope." This typically happens when the resource or subscription you're trying to set the alert on either:
   • Is not available or has been deleted.
     • Does not have the appropriate permissions or access control settings.
   Solution for Scope Error:
   • Double-check the subscription and resource group to ensure they are valid and accessible.
   • Ensure that your role has sufficient permissions (like a Monitoring Contributor or Security Administrator) to set alerts on the selected resources.
   • If the scope resource exists but you're still encountering this error, you might want to manually reselect the correct subscription/resource and retry.

By adjusting the event category and resolving the scope issue, you should be able to configure the JIT access alert as desired.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.