What you need to know
Choose the payload schema before relying on fields in a notification workflow.
Potentially affected
Apply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.
DSE recommendation
DSE recommends documenting the selected schema alongside the parser definition.
Source facts
Microsoft’s Logic Apps notification guide configures the action group with Enable common alert schema set to Yes. If it is set to No, the alert type determines the schema used. The action-group setting is therefore part of the workflow’s incoming payload contract. Microsoft Learn.
Applicability
Apply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.
DSE recommendation
DSE recommends documenting the selected schema alongside the parser definition. Have the alert owner and workflow owner agree how each intended alert type supplies the required identifiers and timestamps. Keep representative sanitized payloads with the change record. Test schema changes in a separate approved action path before directing production alerts to a modified parser.
Verification
Send permitted test notifications for the intended alert types and inspect the workflow’s received payload. Confirm that parsing succeeds and the resulting message contains the correct resource, condition and time information. Exercise a malformed or unexpected-schema sample through a safe test path and verify visible failure handling. Preserve parser and action-group versions together for later troubleshooting.
Official references
Microsoft Learn: Customize alert notifications by using Logic Apps.
Review the official source
Customize alert notifications by using Logic Apps - Azure Monitor | Microsoft Learn · Verified September 17, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE