{"id":596,"date":"2026-01-27T16:00:22","date_gmt":"2026-01-27T16:00:22","guid":{"rendered":"https:\/\/www.digitalsaviour.co.uk\/blog\/?p=596"},"modified":"2026-01-27T16:00:25","modified_gmt":"2026-01-27T16:00:25","slug":"getting-all-azure-alerts-and-their-destinations","status":"publish","type":"post","link":"https:\/\/www.digitalsaviour.co.uk\/blog\/2026\/01\/27\/getting-all-azure-alerts-and-their-destinations\/","title":{"rendered":"Getting ALL Azure alerts and their destinations"},"content":{"rendered":"\n

Azure environments evolve fast and so do the alerts that protect them. Anyone who has tried to audit all alerts across subscriptions knows the pain: different alert types, inconsistent schemas, scattered destinations, and no single place to get the full picture.<\/p>\n\n\n\n

To solve this challenge, I built a comprehensive Azure Resource Graph (ARG) script that consolidates every alert type<\/strong>, normalizes their structure, and exposes real, detailed destination information<\/strong> such as email addresses, webhook endpoints, Logic Apps, Automation runbooks, voice alerts, and more. You can find the full script here<\/p>\n\n\n\n

>> https:\/\/github.com\/DigitalSaviour\/AzureResourceGraphKQL\/blob\/main\/Get-AllAlerts.kql<\/a><\/strong><\/p>\n\n\n\n

This post walks through what the script does, why it exists, and how it helps you gain complete visibility into alerting across your Azure footprint.<\/p>\n\n\n\n

Why This Script Exists<\/h2>\n\n\n\n
Azure provides many ways to configure alerts:<\/p>\n\n\n\n
\n
Metric Alerts<\/strong><\/li>\n\n\n\n
Activity Log Alerts<\/strong><\/li>\n\n\n\n
Log Alerts (Scheduled Query Rules)<\/strong><\/li>\n\n\n\n
Classic Alerts<\/strong><\/li>\n\n\n\n
Smart Detection Rules<\/strong><\/li>\n\n\n\n
Smart Detector Alerts (Alerts Management)<\/strong><\/li>\n\n\n\n
Web Tests<\/strong><\/li>\n\n\n\n
Action Groups<\/strong><\/li>\n<\/ul>\n\n\n\n
Each alert type stores its configuration differently. That means if you want to answer the simple question:<\/p>\n\n\n\n
\n
\u201cWhat are all my alert destinations?\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n
\u2026you would normally need multiple queries, manual joins, and hours of digging.<\/p>\n\n\n\n
This script solves that by providing one unified query<\/strong> that returns everything in a consistent structure.<\/p>\n\n\n\n
What the Script Covers<\/h2>\n\n\n\n
The `Get-AllAlerts.kql<\/code> script consolidates alerts across the following resource types:<\/p>\n\n\n\n`
`\nmicrosoft.insights\/metricalerts<\/code><\/li>\n\n\n\n microsoft.insights\/activitylogalerts<\/code><\/li>\n\n\n\n microsoft.insights\/scheduledqueryrules<\/code><\/li>\n\n\n\n microsoft.insights\/alertrules<\/code><\/li>\n\n\n\n microsoft.insights\/components\/smartdetectionrule<\/code><\/li>\n\n\n\n microsoft.alertsmanagement\/smartdetectoralertrules<\/code><\/li>\n\n\n\n microsoft.insights\/webtests<\/code><\/li>\n\n\n\n microsoft.alertsmanagement\/alerts<\/code><\/li>\n\n\n\n`
`microsoft.insights\/actiongroups<\/code><\/li>\n<\/ul>\n\n\n\nWhat the Script Outputs<\/h2>\n\n\n\nThe script produces a clean, consolidated dataset including:<\/p>\n\n\n\n`\ud83d\udd14 Alert Metadata<\/strong><\/h3>\n\n\n\n\nAlert Name<\/li>\n\n\n\n Alert Type (Metric, Log, Activity Log, Classic, etc.)<\/li>\n\n\n\n Severity<\/li>\n\n\n\n Enabled\/Disabled status<\/li>\n\n\n\n Description<\/li>\n\n\n\n Subscription & Resource Group<\/li>\n\n\n\n Location<\/li>\n<\/ul>\n\n\n\n\ud83d\udcec Destination Details (the big one)<\/strong><\/h3>\n\n\n\nUnlike standard ARG queries that only surface Action Group IDs, this script expands and joins the underlying action group configuration, providing:<\/p>\n\n\n\n \nEmail receivers<\/strong> (including exact recipient addresses)<\/li>\n\n\n\n SMS receivers<\/strong><\/li>\n\n\n\n Webhook endpoints<\/strong><\/li>\n\n\n\n Logic App receivers<\/strong><\/li>\n\n\n\n Automation runbook receivers<\/strong><\/li>\n\n\n\n Azure App Push<\/strong><\/li>\n\n\n\n Voice call receivers<\/strong><\/li>\n\n\n\n Azure Function receivers<\/strong><\/li>\n\n\n\n ARM role receivers<\/strong><\/li>\n\n\n\n Event Hub receivers<\/strong><\/li>\n<\/ul>\n\n\n\nWhy This Matters<\/h2>\n\n\n\n \u2714 Full visibility for security teams<\/strong><\/h3>\n\n\n\nSee exactly where security alerts are routed \u2013 especially critical when validating email addresses, webhook URLs, and automation chains.<\/p>\n\n\n\n \u2714 Auditing & compliance<\/strong><\/h3>\n\n\n\nUseful for ISO, SOC 2, PCI, and internal IT audits. You can produce a full alert inventory in seconds.<\/p>\n\n\n\n \u2714 Consolidation after cloud migrations<\/strong><\/h3>\n\n\n\nIf you\u2019ve merged subscriptions or onboarded new landing zones, this query instantly highlights missing, duplicated, or broken alert configurations.<\/p>\n\n\n\n \u2714 FinOps & Governance<\/strong><\/h3>\n\n\n\nIdentify:<\/p>\n\n\n\n \nAlerts not enabled<\/li>\n\n\n\n Alerts pointing to decommissioned endpoints<\/li>\n\n\n\n Action Groups with outdated contacts<\/li>\n<\/ul>\n\n\n\n\u2714 Troubleshooting \u201cwe didn\u2019t get the alert\u201d<\/strong><\/h3>\n\n\n\nEasily verify whether:<\/p>\n\n\n\n \nDestinations were configured<\/li>\n\n\n\n Addresses were correct<\/li>\n\n\n\n Action Groups were attached<\/li>\n<\/ul>\n\n\n\n \n\n\n\nHow to Use It<\/strong><\/h2>\n\n\n\n\nOpen Azure Resource Graph Explorer<\/strong> in the Azure Portal.<\/li>\n\n\n\n Paste in the contents of the Get-AllAlerts.kql<\/code> script.<\/li>\n\n\n\n Run the query across:\n\nAll subscriptions<\/li>\n\n\n\n A management group<\/li>\n\n\n\n A tenant<\/li>\n<\/ul>\n<\/li>\n\n\n\n Export results to CSV if needed.<\/li>\n<\/ol>\n\n\n\nConclusion<\/h2>\n\n\n\nThe Get-AllAlerts.kql<\/code> script removes one of the biggest pain points in Azure governance: alert visibility<\/strong>. Instead of jumping between portal pages and resource types, you get a single, unified, human\u2011readable output describing your entire alerting landscape \u2014 including the full details of the destinations that matter most.<\/p>\n\n\n\n If you haven\u2019t tried it yet, you can grab the script here:<\/p>\n\n\n\n >> https:\/\/github.com\/DigitalSaviour\/AzureResourceGraphKQL\/blob\/main\/Get-AllAlerts.kql<\/a><\/strong><\/p>\n<\/body>","protected":false},"excerpt":{"rendered":" Azure environments evolve fast and so do the alerts that protect them. Anyone who has tried to audit all alerts across subscriptions knows the pain: different alert types, inconsistent schemas, scattered destinations, and no single place to get the full picture. To solve this challenge, I built a comprehensive Azure Resource Graph (ARG) script that […]<\/p>\n","protected":false},"author":1,"featured_media":597,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[81,10,80],"tags":[],"class_list":["post-596","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","category-development","category-kql"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t