{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/route-azure-service-health-alerts-outside-workload/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/",
        "slug": "route-azure-service-health-alerts-outside-workload",
        "url": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/route-azure-service-health-alerts-outside-workload/"
        },
        "title": "Route Azure Service Health alerts outside the affected workload",
        "summary": "Configure targeted Azure Service Health alerts and deliver them through channels that do not share the workload's main failure path.",
        "format": {
            "slug": "playbook",
            "name": "Playbook"
        },
        "priority": {
            "slug": "important",
            "name": "Important"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-08-25T21:34:25+00:00",
        "modified_at": "2026-08-26T13:27:46+00:00",
        "reviewed_on": "2026-08-25",
        "reading_minutes": 3,
        "word_count": 500,
        "potentially_affected": "Organizations operating critical workloads in Microsoft Azure subscriptions and regions",
        "dse_recommendation": "Create owned Service Health alert rules by service and region, route them through resilient action groups, and test receipt and escalation.",
        "primary_source": {
            "name": "Create Service Health alerts in the Azure portal",
            "url": "https://learn.microsoft.com/en-us/azure/service-health/alerts-activity-log-service-notifications-portal",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>Azure Service Health can provide service-specific notifications, but an alert that goes to an unattended mailbox or a workflow inside the affected dependency does not improve response. Routing and ownership are part of the continuity control.</p>\n<h2>Source fact:</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/service-health/alerts-activity-log-service-notifications-portal\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft documents</a> that Azure Service Health notifications are stored in the Azure activity log and can be matched by activity-log alert rules. Rules can filter service-health event categories and affected subscription, service, region, and tenant directory. Tenant-level Service Health alerts are currently Preview. An alert can invoke an Azure Monitor action group.</p>\n<p>Microsoft lists action-group delivery and automation options including email, SMS, push notification, webhook, Logic Apps, and IT service-management integration, subject to the selected service&#8217;s support and configuration. The documentation distinguishes Service Health notifications from Resource Health events. A configured rule signals matching published information; it does not prove the application&#8217;s impact, detect every workload fault, or restore service.</p>\n<h2>Boundary</h2>\n<p>Azure features, limits, schemas, and interfaces can change, so current product documentation and subscription behavior must be verified. Notification timing and content depend on Microsoft&#8217;s service-health process. The current portal guidance says Service Health alerts are supported only in public clouds in the Global region and that associated action groups must use the Global region; recheck those limits before implementation. Action groups can fail because of identity, network, quota, recipient, integration, or downstream-provider issues. A wide rule may overwhelm responders, while a narrow rule can miss a relevant dependency in another subscription or region.</p>\n<h2>Applicability questions</h2>\n<ul>\n<li>Which subscriptions, regions, Azure services, and tenants underpin each critical workload?</li>\n<li>Who owns a notification for service issue, planned maintenance, health advisory, or security advisory?</li>\n<li>Which primary and secondary delivery paths avoid the same identity, network, or Azure dependency?</li>\n<li>How is an Azure notification correlated with Resource Health, application telemetry, and user impact?</li>\n<li>Who reviews new subscriptions and services for alert coverage?</li>\n</ul>\n<h2>DSE recommendation:</h2>\n<p>Map workload dependencies first, then create alert rules whose scope and filters match the services and regions the organization can act on. Name an operational owner and backup for every rule. Use an action group with at least two appropriate channels and consider an external incident path that does not depend on the workload&#8217;s own tenant sign-in, application, or region.</p>\n<p>Test the action group through Microsoft&#8217;s supported test function where available and validate each recipient or integration end to end. Exercise a sample notification: classify relevance, open the official detail, correlate workload telemetry, contact service owners, and record a decision. Monitor rule disablement, action-group changes, delivery failure, and ownership drift. Include alert recreation and contact data in infrastructure-as-code or controlled configuration where practical.</p>\n<h2>Verification and evidence</h2>\n<p>Keep the subscription/service dependency map, exported alert rules and action groups, owners, channel test results, delivery timestamps, ticket linkage, exercise record, and exceptions. Periodically sample activity-log service-health events and confirm expected rules fired. Do not use a quiet period alone as evidence that alerts work; generate an approved test and verify acknowledgment through the secondary path.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://learn.microsoft.com/en-us/azure/service-health/alerts-activity-log-service-notifications-portal\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Create Service Health alerts</a></li>\n</ul>",
        "content_text": "Azure Service Health can provide service-specific notifications, but an alert that goes to an unattended mailbox or a workflow inside the affected dependency does not improve response. Routing and ownership are part of the continuity control.\nSource fact:\nMicrosoft documents that Azure Service Health notifications are stored in the Azure activity log and can be matched by activity-log alert rules. Rules can filter service-health event categories and affected subscription, service, region, and tenant directory. Tenant-level Service Health alerts are currently Preview. An alert can invoke an Azure Monitor action group.\nMicrosoft lists action-group delivery and automation options including email, SMS, push notification, webhook, Logic Apps, and IT service-management integration, subject to the selected service’s support and configuration. The documentation distinguishes Service Health notifications from Resource Health events. A configured rule signals matching published information; it does not prove the application’s impact, detect every workload fault, or restore service.\nBoundary\nAzure features, limits, schemas, and interfaces can change, so current product documentation and subscription behavior must be verified. Notification timing and content depend on Microsoft’s service-health process. The current portal guidance says Service Health alerts are supported only in public clouds in the Global region and that associated action groups must use the Global region; recheck those limits before implementation. Action groups can fail because of identity, network, quota, recipient, integration, or downstream-provider issues. A wide rule may overwhelm responders, while a narrow rule can miss a relevant dependency in another subscription or region.\nApplicability questions\n\nWhich subscriptions, regions, Azure services, and tenants underpin each critical workload?\nWho owns a notification for service issue, planned maintenance, health advisory, or security advisory?\nWhich primary and secondary delivery paths avoid the same identity, network, or Azure dependency?\nHow is an Azure notification correlated with Resource Health, application telemetry, and user impact?\nWho reviews new subscriptions and services for alert coverage?\n\nDSE recommendation:\nMap workload dependencies first, then create alert rules whose scope and filters match the services and regions the organization can act on. Name an operational owner and backup for every rule. Use an action group with at least two appropriate channels and consider an external incident path that does not depend on the workload’s own tenant sign-in, application, or region.\nTest the action group through Microsoft’s supported test function where available and validate each recipient or integration end to end. Exercise a sample notification: classify relevance, open the official detail, correlate workload telemetry, contact service owners, and record a decision. Monitor rule disablement, action-group changes, delivery failure, and ownership drift. Include alert recreation and contact data in infrastructure-as-code or controlled configuration where practical.\nVerification and evidence\nKeep the subscription/service dependency map, exported alert rules and action groups, owners, channel test results, delivery timestamps, ticket linkage, exercise record, and exceptions. Periodically sample activity-log service-health events and confirm expected rules fired. Do not use a quiet period alone as evidence that alerts work; generate an approved test and verify acknowledgment through the secondary path.\nOfficial references\n\nMicrosoft Learn: Create Service Health alerts",
        "content_markdown": "Azure Service Health can provide service-specific notifications, but an alert that goes to an unattended mailbox or a workflow inside the affected dependency does not improve response. Routing and ownership are part of the continuity control.\n\n## Source fact:\n\n[Microsoft documents](https://learn.microsoft.com/en-us/azure/service-health/alerts-activity-log-service-notifications-portal) that Azure Service Health notifications are stored in the Azure activity log and can be matched by activity-log alert rules. Rules can filter service-health event categories and affected subscription, service, region, and tenant directory. Tenant-level Service Health alerts are currently Preview. An alert can invoke an Azure Monitor action group.\n\nMicrosoft lists action-group delivery and automation options including email, SMS, push notification, webhook, Logic Apps, and IT service-management integration, subject to the selected service’s support and configuration. The documentation distinguishes Service Health notifications from Resource Health events. A configured rule signals matching published information; it does not prove the application’s impact, detect every workload fault, or restore service.\n\n## Boundary\n\nAzure features, limits, schemas, and interfaces can change, so current product documentation and subscription behavior must be verified. Notification timing and content depend on Microsoft’s service-health process. The current portal guidance says Service Health alerts are supported only in public clouds in the Global region and that associated action groups must use the Global region; recheck those limits before implementation. Action groups can fail because of identity, network, quota, recipient, integration, or downstream-provider issues. A wide rule may overwhelm responders, while a narrow rule can miss a relevant dependency in another subscription or region.\n\n## Applicability questions\n\n- Which subscriptions, regions, Azure services, and tenants underpin each critical workload?\n\n- Who owns a notification for service issue, planned maintenance, health advisory, or security advisory?\n\n- Which primary and secondary delivery paths avoid the same identity, network, or Azure dependency?\n\n- How is an Azure notification correlated with Resource Health, application telemetry, and user impact?\n\n- Who reviews new subscriptions and services for alert coverage?\n\n## DSE recommendation:\n\nMap workload dependencies first, then create alert rules whose scope and filters match the services and regions the organization can act on. Name an operational owner and backup for every rule. Use an action group with at least two appropriate channels and consider an external incident path that does not depend on the workload’s own tenant sign-in, application, or region.\n\nTest the action group through Microsoft’s supported test function where available and validate each recipient or integration end to end. Exercise a sample notification: classify relevance, open the official detail, correlate workload telemetry, contact service owners, and record a decision. Monitor rule disablement, action-group changes, delivery failure, and ownership drift. Include alert recreation and contact data in infrastructure-as-code or controlled configuration where practical.\n\n## Verification and evidence\n\nKeep the subscription/service dependency map, exported alert rules and action groups, owners, channel test results, delivery timestamps, ticket linkage, exercise record, and exceptions. Periodically sample activity-log service-health events and confirm expected rules fired. Do not use a quiet period alone as evidence that alerts work; generate an approved test and verify acknowledgment through the secondary path.\n\n## Official references\n\n- [Microsoft Learn: Create Service Health alerts](https://learn.microsoft.com/en-us/azure/service-health/alerts-activity-log-service-notifications-portal)"
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/",
                "url": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-08-25"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Route Azure Service Health alerts outside the affected workload",
                        "item": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/#article",
                "identifier": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/",
                "url": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/",
                "headline": "Route Azure Service Health alerts outside the affected workload",
                "description": "Configure targeted Azure Service Health alerts and deliver them through channels that do not share the workload's main failure path.",
                "abstract": "Configure targeted Azure Service Health alerts and deliver them through channels that do not share the workload's main failure path.",
                "articleBody": "Azure Service Health can provide service-specific notifications, but an alert that goes to an unattended mailbox or a workflow inside the affected dependency does not improve response. Routing and ownership are part of the continuity control.\nSource fact:\nMicrosoft documents that Azure Service Health notifications are stored in the Azure activity log and can be matched by activity-log alert rules. Rules can filter service-health event categories and affected subscription, service, region, and tenant directory. Tenant-level Service Health alerts are currently Preview. An alert can invoke an Azure Monitor action group.\nMicrosoft lists action-group delivery and automation options including email, SMS, push notification, webhook, Logic Apps, and IT service-management integration, subject to the selected service’s support and configuration. The documentation distinguishes Service Health notifications from Resource Health events. A configured rule signals matching published information; it does not prove the application’s impact, detect every workload fault, or restore service.\nBoundary\nAzure features, limits, schemas, and interfaces can change, so current product documentation and subscription behavior must be verified. Notification timing and content depend on Microsoft’s service-health process. The current portal guidance says Service Health alerts are supported only in public clouds in the Global region and that associated action groups must use the Global region; recheck those limits before implementation. Action groups can fail because of identity, network, quota, recipient, integration, or downstream-provider issues. A wide rule may overwhelm responders, while a narrow rule can miss a relevant dependency in another subscription or region.\nApplicability questions\n\nWhich subscriptions, regions, Azure services, and tenants underpin each critical workload?\nWho owns a notification for service issue, planned maintenance, health advisory, or security advisory?\nWhich primary and secondary delivery paths avoid the same identity, network, or Azure dependency?\nHow is an Azure notification correlated with Resource Health, application telemetry, and user impact?\nWho reviews new subscriptions and services for alert coverage?\n\nDSE recommendation:\nMap workload dependencies first, then create alert rules whose scope and filters match the services and regions the organization can act on. Name an operational owner and backup for every rule. Use an action group with at least two appropriate channels and consider an external incident path that does not depend on the workload’s own tenant sign-in, application, or region.\nTest the action group through Microsoft’s supported test function where available and validate each recipient or integration end to end. Exercise a sample notification: classify relevance, open the official detail, correlate workload telemetry, contact service owners, and record a decision. Monitor rule disablement, action-group changes, delivery failure, and ownership drift. Include alert recreation and contact data in infrastructure-as-code or controlled configuration where practical.\nVerification and evidence\nKeep the subscription/service dependency map, exported alert rules and action groups, owners, channel test results, delivery timestamps, ticket linkage, exercise record, and exceptions. Periodically sample activity-log service-health events and confirm expected rules fired. Do not use a quiet period alone as evidence that alerts work; generate an approved test and verify acknowledgment through the secondary path.\nOfficial references\n\nMicrosoft Learn: Create Service Health alerts",
                "datePublished": "2026-08-25T21:34:25+00:00",
                "dateModified": "2026-08-26T13:27:46+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/route-azure-service-health-alerts-outside-workload/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Route Azure Service Health alerts outside the affected workload"
                },
                "articleSection": [
                    "Business Continuity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "IT",
                    "Playbook",
                    "Important priority"
                ],
                "genre": "Playbook",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 500,
                "timeRequired": "PT3M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Create Service Health alerts in the Azure portal",
                    "url": "https://learn.microsoft.com/en-us/azure/service-health/alerts-activity-log-service-notifications-portal"
                }
            }
        ]
    }
}