Azure subscriptions should have an Activity Log Alert configured for specific Administrative operations
This policy audits specific Administrative operations with no activity log alerts configured. An activity log alert should exist for specific Administrative operations on the subscription.
What this control checks
An enabled activity log alert must exist for specific Administrative operations
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "An activity log alert should exist for specific Administrative operations" (b954148f-4c11-4c38-8221-be76711e194a); PowerPipe control azure_compliance.control.monitor_log_alert_for_administrative_operations.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 1270.09ad1System.12-09.ad (09.10 Monitoring) and 1271.09ad1System.1-09.ad (09.10 Monitoring).
Framework mappings
The clauses this control is mapped to in each framework.
- 1270.09ad1System.12-09.ad 09.10 Monitoring
- 1271.09ad1System.1-09.ad 09.10 Monitoring
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
monitor_log_alert_for_administrative_operations - Powerpipe Control:
azure_compliance.control.monitor_log_alert_for_administrative_operations - Azure Policy Definition:
b954148f-4c11-4c38-8221-be76711e194a
Last reviewed: 2026-10-13