Azure Alert - Notification received by email contains all data but not the necessary items

Hello Salam ELIAS,

Thanks for posting your question in Microsoft Q&A forum

The behavior you’re seeing is expected due to the way Activity Log alerts and Terraform interact with Azure.

• Activity Log Alerts and ARM Deployments Alerts based on the Create Deployment (Microsoft.Resources/deployments) signal fire when an ARM deployment resource is created. This happens when you deploy resources via ARM templates (portal, CLI, PowerShell), because Azure logs a deployment event in the Activity Log.
• Terraform Behavior: Terraform interacts directly with the Azure Resource Manager API to create or update resources. Terraform does not create an ARM deployment object for its operations, so no Create Deployment event is generated in the Activity Log. As a result, your current alert will not trigger for Terraform-created resources.

Recommended Approach:

1. Instead of monitoring the Create Deployment event, you can create an Activity Log alert for any resource write operation:

• Scope: Subscription
• Signal type: Activity Log → Administrative
• Operation name: Microsoft.Resources/subscriptions/resourceGroups/resources/write
• Action group: Email

This setup will trigger alerts for both resource creations and updates, regardless of whether they are made via Terraform, the Azure portal, CLI, or ARM templates.

2. You can use a Log Analytics query alert by sending Activity Logs to a Log Analytics workspace and running a query like:

AzureActivity
| where OperationNameValue endswith "/write"
| where ActivityStatusValue == "Success"

Then, create a scheduled alert based on this query. This approach provides more granular control and works for all deployment methods, including Terraform.

Please try the suggested approach and let me know how it works, and feel free to reach out if you have any questions.