Azure Monitor alert

Question

Azure Monitor alert

Shubham Prajapati 40

Hi, can we create a monitor alert for any new resource creation in a subscription. but i want some users to be excluded.

In monitor we have the signal, but filtering option is not their it triggers for all user's operation but i want to exclude some user's operation.

KQL option is there, but it involves a cost.

Suchitra Suregaunkar 1,885 Reputation points Microsoft External Staff Moderator

2025-10-17T01:45:58.7966667+00:00
Hello Shubham Prajapati

Thank you for posting your query on Microsoft Q&A platform.

No, Azure Monitor’s built-in Activity Log alerts cannot filter by user. They trigger for all matching operations. The only way to exclude users is by using Log Analytics (KQL), which requires a workspace and incurs cost.

Activity Log Alerts

You can create alerts for resource creation (Administrative category → Microsoft.Resources/deployments/write), but filtering by user is not supported in the UI.

KQL-based Alerts (Log Analytics)

To exclude users, you need a log query on the AzureActivity table:
AzureActivity | where OperationNameValue has "Microsoft.Resources/deployments/write" | where ActivityStatusValue == "Success" | where Caller !in ("******@domain.com","******@domain.com")

This works, but requires a Log Analytics workspace that adds cost.

Alert Processing Rules

These can suppress notifications but cannot filter by user.

There is no zero-cost native option to exclude users. If filtering by user is critical, KQL-based alerts are the only solution.

Thanks,

Suchitra.

Answer recommended by moderator

0 additional answers

Your answer

Suchitra Suregaunkar 1,885 Reputation points Microsoft External Staff Moderator

2025-10-17T01:45:58.7966667+00:00

Hello Shubham Prajapati

Thank you for posting your query on Microsoft Q&A platform.

No, Azure Monitor’s built-in Activity Log alerts cannot filter by user. They trigger for all matching operations. The only way to exclude users is by using Log Analytics (KQL), which requires a workspace and incurs cost.

Activity Log Alerts

You can create alerts for resource creation (Administrative category → Microsoft.Resources/deployments/write), but filtering by user is not supported in the UI.

KQL-based Alerts (Log Analytics)

To exclude users, you need a log query on the AzureActivity table:
AzureActivity | where OperationNameValue has "Microsoft.Resources/deployments/write" | where ActivityStatusValue == "Success" | where Caller !in ("******@domain.com","******@domain.com")

This works, but requires a Log Analytics workspace that adds cost.

Alert Processing Rules

These can suppress notifications but cannot filter by user.

There is no zero-cost native option to exclude users. If filtering by user is critical, KQL-based alerts are the only solution.

Thanks,

Suchitra.

Answer 1

Hi,

Azure Activity log alerts only support inclusion and not exclusions. You can do filtering with Log Analytics alerts. Example query would look like:

AzureActivity
| where OperationNameValue endswith "/WRITE" and ActivitySubstatusValue =~ 'Created' and OperationNameValue !~ 'MICROSOFT.RESOURCES/DEPLOYMENTS/WRITE'
| where Caller  !in ("******@contoso.com","******@contoso.com")

Note that only write operations that are with status Created are included to avoid getting notified on write operations on resources that already exists. The deployments resource is excluded as those are creation of deployments which are resource on its own but my understanding is that is not what you are looking for. You are looking for resources like VMs, SQL, etc. Deployments are resources that are created/written when there is ARM or Bicep deployment happening which does not necessary means new resources are created with that deployment and resources can also be created without actual deployment happening.

Alternatively you could use Alert processing rules. Keep in mind that in that case the alert instance will still be generated but you can suppress any actions/notifications done via action groups. You can use Alert Context filter. That will filter based on any payload value matched. Sample payload for Azure activity log alert. Note that you also need to filter on the Monitor service. Other filters can be add by you if you need ti.

Filter on Azure Activity log users

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Share via

Azure Monitor alert

0 additional answers

Your answer