How to get the exact alert messages in Notification for detailed Managed Identity operation in Container Apps

Hi ,

Thanks for reaching out to Microsoft Q&A.

To create an alert for Managed Identity operations, including turning ON/OFF System-Assigned or User-Assigned Managed Identities for Container Apps or other resources, follow these steps:

1. Enable Diagnostic Settings:
   • Navigate to the Container App in the Azure portal.
   • Go to Diagnostic Settings. Add a diagnostic setting to log Administrative operations to Log Analytics, Event Hub, or Storage Account.
2. Use Azure Activity Logs: The notifications you see are derived from Activity Logs. These logs capture all management operations. To filter for Managed Identity actions:
   • Go to Activity Logs for your Container App or subscription.
   • Use filters like Operation Name (example: Register managed identity, Deregister managed identity, Add user-assigned identity, Remove user-assigned identity).
   • Verify the detailed records for Managed Identity actions.
3. Set Up Alerts:
   • Navigate to Monitor in the Azure portal.
   • Go to Alerts > Create > Alert Rule.
   • Select a Scope: Choose the specific Container App or subscription.
   • Add Condition: Use "Administrative operation" as the signal. Add filters for specific operation names (ex: Register managed identity, Deregister managed identity).
   • Configure Action Groups to send notifications (email, SMS, etc.).
   • Save and enable the alert.
4. Query in Log Analytics: If you're logging diagnostic data to Log Analytics, you can write a KQL query to get specific Managed Identity events:

   AzureActivity | where ResourceProvider == "Microsoft.ManagedIdentity" | where OperationNameValue in ("Register managed identity", "Deregister managed identity", "Add user-assigned identity", "Remove user-assigned identity") | project TimeGenerated, OperationName, Resource, Caller, Status

5. Test the Alert: Enable/disable the Managed Identity to generate a test log and ensure your alert triggers as expected.

This will provide granular alerting and tracking for Managed Identity operations in Container Apps or other Azure resources.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.