# Match a Logic App alert parser to the action group's schema setting

> Choose the payload schema before relying on fields in a notification workflow.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:40+00:00
- Modified: 2026-09-17T16:46:30+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Choose the payload schema before relying on fields in a notification workflow.

## Potentially affected

Apply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.

## DSE recommendation

DSE recommends documenting the selected schema alongside the parser definition.

## Article

## Source facts

Microsoft’s Logic Apps notification guide configures the action group with Enable common alert schema set to Yes. If it is set to No, the alert type determines the schema used. The action-group setting is therefore part of the workflow’s incoming payload contract. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-logic-apps).

## Applicability

Apply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.

## DSE recommendation

DSE recommends documenting the selected schema alongside the parser definition. Have the alert owner and workflow owner agree how each intended alert type supplies the required identifiers and timestamps. Keep representative sanitized payloads with the change record. Test schema changes in a separate approved action path before directing production alerts to a modified parser.

## Verification

Send permitted test notifications for the intended alert types and inspect the workflow’s received payload. Confirm that parsing succeeds and the resulting message contains the correct resource, condition and time information. Exercise a malformed or unexpected-schema sample through a safe test path and verify visible failure handling. Preserve parser and action-group versions together for later troubleshooting.

## Official references

[Microsoft Learn: Customize alert notifications by using Logic Apps](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-logic-apps).

## Primary reference

- Name: Customize alert notifications by using Logic Apps - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-logic-apps
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Match a Logic App alert parser to the action group's schema setting,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-200-match-a-logic-app-alert-parser-to-the-action-group-s-schema-setting/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.