Alert for system Identity or user identity on Azure VM

Question

We are trying to create an alert when any User Identity\System Identity is added\removed on Azure VM's or VMSS we tried to create it using Azure resource graph but not working.  

arg("").resources | where type == "microsoft.compute/virtualmachines"  // Filter for Virtual Machines | where subscriptionId == "abcd"  // Specified subscription ID | extend identity = parse_json(identity)  // Parse the identity column | extend identityType = tostring(identity.type)  // Extract identity type | extend userAssignedIdentities = todynamic(identity.userAssignedIdentities)  // Explicitly cast user-assigned identities to dynamic | where isnull(identityType)  // Check for missing identity type     or identityType == "None"  // Check if identity is disabled     or (identityType contains "SystemAssigned" and isnull(userAssignedIdentities))  // Check if user-assigned identities are missing     or (identityType contains "UserAssigned" and (isnull(userAssignedIdentities) or array_length(bag_keys(userAssignedIdentities)) < 2))  // Check for fewer user-assigned identities | extend TimeGenerated = todatetime(now())  // Add synthetic TimeGenerated | project     TimeGenerated,  // Ensure TimeGenerated is available     name,     RenderedDescription = strcat("[TEST-Alert] VM Name: [", name, "] has System/User identity Disabled/Missing")  

please help.

Answer 1

Hello Srikanthreddy Adla,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to create alert for system Identity or user identity on Azure VMs whenever there is change.

You will need to improve your query in the correct resource type, having identity parsing correctly and make sure the extend and project statements are correctly used to capture the necessary fields.

The below is a modified version of your query:

arg("").resources
| where type in ("microsoft.compute/virtualmachines", "microsoft.compute/virtualmachinescalesets")  // Filter for VMs and VMSS
| where subscriptionId == "abcd"  // Specified subscription ID
| extend identity = parse_json(identity)  // Parse the identity column
| extend identityType = tostring(identity.type)  // Extract identity type
| extend userAssignedIdentities = todynamic(identity.userAssignedIdentities)  // Explicitly cast user-assigned identities to dynamic
| where isnull(identityType)  // Check for missing identity type
    or identityType == "None"  // Check if identity is disabled
    or (identityType contains "SystemAssigned" and isnull(userAssignedIdentities))  // Check if user-assigned identities are missing
    or (identityType contains "UserAssigned" and (isnull(userAssignedIdentities) or array_length(bag_keys(userAssignedIdentities)) < 2))  // Check for fewer user-assigned identities
| extend TimeGenerated = todatetime(now())  // Add synthetic TimeGenerated
| project TimeGenerated, name, RenderedDescription = strcat("[TEST-Alert] VM/VMSS Name: [", name, "] has System/User identity Disabled/Missing")

Also, you can use Azure Monitor to create alerts based on log queries, it will provide more flexibility and reliability.

For more understanding check the Azure documentation on managed identities and for more detailed guidance check how to configure managed identities scale sets

I hope this is helpful! Do not hesitate to let me know if you have any other questions.

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.