Azure environments evolve fast and so do the alerts that protect them. Anyone who has tried to audit all alerts across subscriptions knows the pain: different alert types, inconsistent schemas, scattered destinations, and no single place to get the full picture.
To solve this challenge, I built a comprehensive Azure Resource Graph (ARG) script that consolidates every alert type, normalizes their structure, and exposes real, detailed destination information such as email addresses, webhook endpoints, Logic Apps, Automation runbooks, voice alerts, and more. You can find the full script here
>> https://github.com/DigitalSaviour/AzureResourceGraphKQL/blob/main/Get-AllAlerts.kql
This post walks through what the script does, why it exists, and how it helps you gain complete visibility into alerting across your Azure footprint.
Why This Script Exists
Azure provides many ways to configure alerts:
- Metric Alerts
- Activity Log Alerts
- Log Alerts (Scheduled Query Rules)
- Classic Alerts
- Smart Detection Rules
- Smart Detector Alerts (Alerts Management)
- Web Tests
- Action Groups
Each alert type stores its configuration differently. That means if you want to answer the simple question:
“What are all my alert destinations?”
…you would normally need multiple queries, manual joins, and hours of digging.
This script solves that by providing one unified query that returns everything in a consistent structure.
What the Script Covers
The Get-AllAlerts.kql script consolidates alerts across the following resource types:
microsoft.insights/metricalertsmicrosoft.insights/activitylogalertsmicrosoft.insights/scheduledqueryrulesmicrosoft.insights/alertrulesmicrosoft.insights/components/smartdetectionrulemicrosoft.alertsmanagement/smartdetectoralertrulesmicrosoft.insights/webtestsmicrosoft.alertsmanagement/alertsmicrosoft.insights/actiongroups
What the Script Outputs
The script produces a clean, consolidated dataset including:
🔔 Alert Metadata
- Alert Name
- Alert Type (Metric, Log, Activity Log, Classic, etc.)
- Severity
- Enabled/Disabled status
- Description
- Subscription & Resource Group
- Location
📬 Destination Details (the big one)
Unlike standard ARG queries that only surface Action Group IDs, this script expands and joins the underlying action group configuration, providing:
- Email receivers (including exact recipient addresses)
- SMS receivers
- Webhook endpoints
- Logic App receivers
- Automation runbook receivers
- Azure App Push
- Voice call receivers
- Azure Function receivers
- ARM role receivers
- Event Hub receivers
Why This Matters
✔ Full visibility for security teams
See exactly where security alerts are routed – especially critical when validating email addresses, webhook URLs, and automation chains.
✔ Auditing & compliance
Useful for ISO, SOC 2, PCI, and internal IT audits. You can produce a full alert inventory in seconds.
✔ Consolidation after cloud migrations
If you’ve merged subscriptions or onboarded new landing zones, this query instantly highlights missing, duplicated, or broken alert configurations.
✔ FinOps & Governance
Identify:
- Alerts not enabled
- Alerts pointing to decommissioned endpoints
- Action Groups with outdated contacts
✔ Troubleshooting “we didn’t get the alert”
Easily verify whether:
- Destinations were configured
- Addresses were correct
- Action Groups were attached
How to Use It
- Open Azure Resource Graph Explorer in the Azure Portal.
- Paste in the contents of the
Get-AllAlerts.kqlscript. - Run the query across:
- All subscriptions
- A management group
- A tenant
- Export results to CSV if needed.
Conclusion
The Get-AllAlerts.kql script removes one of the biggest pain points in Azure governance: alert visibility. Instead of jumping between portal pages and resource types, you get a single, unified, human‑readable output describing your entire alerting landscape — including the full details of the destinations that matter most.
If you haven’t tried it yet, you can grab the script here:
>> https://github.com/DigitalSaviour/AzureResourceGraphKQL/blob/main/Get-AllAlerts.kql
