cross tenant alerting

@Robert Macdougall, thank you for posting this question on Microsoft Q&A.

The Azure update you referred are related to forwarding targets (notification, action group etc.) of alerts after they are created. However, the issue you are facing seems to be related to the alert creation process itself. The error points to the expected behavior that "alert rule should be in the same tenant as the target of alert/resource being monitored". I will have to check if this behavior is true, even for lighthouse scenarios.

I tested a sample scenario where I created and saved the log-based alert rule in "managed by" subscription targeting a LA workspace in "managed" subscription. I don't get any error as you have mentioned - "Alert rule should be in the same tenant as the target of alert/resource being monitored" but I don't see any alert being created as well in "the managed" by subscription.

Can you please let me know where you see the error - "alert rule should be in the same tenant as the target of alert/resource being monitored"?

many thanks for the update.

where i see the error is

in the Alert rule, i find that when it should fire it creates an event in 'Diagnose and solve issues' which says 'An alert fired from your alert rule was blocked due to an unauthorized target resource.'

when i then click into viewing resource health it shows the extra detail

'Alert is blocked due to unauthorized target resource (target resource tenant is different from rule tenant).'

i have attached some images of these events

for detail on the alert config

the rule is saved in the managing tenant, it is scoped to a LA workspace in the same tenant.

that workspace has some functions that create the union of workspaces from the managed subscriptions and this function is used in the alert KQL to query the data

@Robert Macdougall, thank you for the update.

I have reached out to the Alerting team and will get back to this thread soon. Based on my observation, the tenant difference is creating an issue here, as the alert target should be in the same tenant where the alert rule is being created.

@Robert Macdougall, apologies for the delayed response.

I heard back from the team that it will require additional information from your alerting environment setup (backend logs etc.). Due to the nature of further investigation required, I would request you to please open a Azure support ticket, so that it can be investigated 1:1. I am sorry for the inconvenience.

mant thanks for your help so far, I have raised the necessary ticket.

I will update here with the findings so that others may find the info if they need it.