I am trying to create alerts when someone changes the IAM RBAC roles or permissions on azure storage accounts using Kusto query

Question

AzureActivity
| where ResourceProviderValue contains "Microsoft.storage" and CategoryValue contains "Administrative"
| where OperationNameValue ==
"Microsoft. Authorization/roleAssignments/write",
"Microsoft. Authorization/roleAssignments/delete",
"Microsoft. Authorization/roleDefinitions/write",
"Microsoft. Authorization/roleDefinitions/delete"
| where ActivityStatusValue in (""Started", "Succeeded", "Failed")
| project TimeGenerated, ResourceId, OperationNameValue, ActivityStatus

Answer 1

I am trying to create alerts when someone changes the IAM RBAC roles or permissions on azure storage accounts using Kusto query.

Alternatively, you can create an alert from the portal when someone changes the IAM RBAC roles on a storage account, follow these steps.

1. Go to Azure Storage account > Activity log > select any Create role assignment operation > New alert rule

2. Select the scope (ex: subscription) > Resource type : Storage accounts.

3. Select the Signal: Create a role assignment

4. Create an action group using your email ID or choose an existing one.

5. To fetch all role assignment and deletion, select all in the status field of the condition tab.

7. After completing all the steps above, you will receive an alert if anyone changes the RBAC role on the storage account, as shown below.