About

This article explains how to fix a failing Azure check about network security group changes. ControlMap checks your Azure connection against its Azure Baseline Controls. One of these checks looks for an activity log alert on the Change Network Security Group event.

With this alert in place, Azure notifies admins and other users when a network security group changes. That way, any suspicious network activity is dealt with at the right time.

Find the failing check in ControlMap

1. Go to Monitor › Compliance Checks.
2. Find the Azure check with the status Failing. To narrow the list, use the filters at the top of the table.
3. Open the Compliance check actions menu on the check's row and select View Evidence, then open the Scan results tab to see the result.

Create the activity log alert in Azure

Do these steps in the Azure portal.

1. Go to Monitor › Alerts and create a new alert rule.
2. Under Scope, select Select Resource.
3. Select your subscription.
4. Under Condition, select Select Condition.
5. In the search box, enter Change Network Security Group, then select Microsoft.Network/networkSecurityGroups/write.
6. Under Action group, select Select action group.
7. Select the action group to attach to the alert rule, or create one if needed, then select Select.
8. Enter an alert rule name and a description.
9. Select a resource group.
10. Create the alert rule.

Run the scan again

1. Go to Monitor › Integrations and open your Azure connection from its card.
2. Select Run Once. A message says the scan is scheduled to start in the next few minutes.
3. When the scan finishes, go back to Monitor › Compliance Checks to see the updated status.

Connections also scan on their weekly schedule, so the status updates on its own if you don't run it manually.

More information

For more on activity log alerts, see Microsoft's activity log alerts article.