azure-monitor-delete-action-group
Delete an action group, silencing the response actions (email, SMS, webhook, Azure Function, Logic App, Automation Runbook) for ALL alert rules that reference it - a high-blast-radius evasion against automated incident response.
match (effective permission)
{
"action": "Microsoft.Insights/actionGroups/delete",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | SecurityService |
| source | <principal> |
| target | <action group (SecurityService node)> |
| permissions | Microsoft.Insights/actionGroups/delete |
| conditions | iam_permission deny_assignment |
| state logic | ACTIVE when the principal holds the delete action at the effective scope with no deny assignment. An action group may be referenced by many alert rules across the scope; its deletion silences response for all of them simultaneously. BLOCKED if deny assignment covers actionGroups/delete. |
Narrative
{principal.name} can delete action group {target.name} (Microsoft.Insights/actionGroups/delete), silencing the response actions (email, webhook, Azure Function invocation, Logic App trigger, Automation Runbook kick-off) for every alert rule that references it. Alerts may still fire and appear in the portal but no automated response executes - a high-blast-radius disarming of incident-response workflows. No resource access is gained.
Raw rule rules/derived/azure/monitor.yaml
id: azure-monitor-delete-action-group
emits: CanDelete
description: "Delete an action group, silencing the response actions (email, SMS, webhook, Azure Function,\
\ Logic App, Automation Runbook) for ALL alert rules that reference it \u2014 a high-blast-radius evasion\
\ against automated incident response."
match_effective_permission:
action: Microsoft.Insights/actionGroups/delete
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: SecurityService
source: <principal>
target: <action group (SecurityService node)>
permissions:
- Microsoft.Insights/actionGroups/delete
conditions:
- iam_permission
- deny_assignment
state_logic: ACTIVE when the principal holds the delete action at the effective scope with no deny assignment.
An action group may be referenced by many alert rules across the scope; its deletion silences response
for all of them simultaneously. BLOCKED if deny assignment covers actionGroups/delete.
confidence: 0.95
derived_from:
- 'effective permission: Microsoft.Insights/actionGroups/delete'
false_positive_note: "DEFENSE EVASION ONLY. An action group deletion is higher-blast-radius than a single\
\ alert rule deletion because every alert rule referencing the group loses its response actions simultaneously.\
\ The alert rules remain and may still trigger (and appear in the portal/API), but none of their actions\
\ fire \u2014 a stealthy disarming of automated response. No resource access is gained. Do NOT chain\
\ to CanExecuteAs or any access edge. Note: if the action group's actions include an Azure Function\
\ or Logic App, those downstream resources' own adapters model their ExecutesAs surface separately\
\ \u2014 deleting the action group does not grant access to those resources."
narrative: "{principal.name} can delete action group {target.name} (Microsoft.Insights/actionGroups/delete),\
\ silencing the response actions (email, webhook, Azure Function invocation, Logic App trigger, Automation\
\ Runbook kick-off) for every alert rule that references it. Alerts may still fire and appear in the\
\ portal but no automated response executes \u2014 a high-blast-radius disarming of incident-response\
\ workflows. No resource access is gained."