GuideInformationCybersecurityIT

Match a Logic App alert parser to the action group's schema setting

Choose the payload schema before relying on fields in a notification workflow.

Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.
DSE visual intelligenceCyber defenseGuide · 1 min read
Executive summary

What you need to know

Choose the payload schema before relying on fields in a notification workflow.

Potentially affected

Apply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.

DSE recommendation

DSE recommends documenting the selected schema alongside the parser definition.

Source facts

Microsoft’s Logic Apps notification guide configures the action group with Enable common alert schema set to Yes. If it is set to No, the alert type determines the schema used. The action-group setting is therefore part of the workflow’s incoming payload contract. Microsoft Learn.

Applicability

Apply this review to a Logic App that consumes Azure Monitor alerts. Identify the action group, schema setting, alert types and fields that the workflow parses. Do not assume all incoming alerts match a sample payload merely because they reach the same workflow.

DSE recommendation

DSE recommends documenting the selected schema alongside the parser definition. Have the alert owner and workflow owner agree how each intended alert type supplies the required identifiers and timestamps. Keep representative sanitized payloads with the change record. Test schema changes in a separate approved action path before directing production alerts to a modified parser.

Verification

Send permitted test notifications for the intended alert types and inspect the workflow’s received payload. Confirm that parsing succeeds and the resulting message contains the correct resource, condition and time information. Exercise a malformed or unexpected-schema sample through a safe test path and verify visible failure handling. Preserve parser and action-group versions together for later troubleshooting.

Official references

Microsoft Learn: Customize alert notifications by using Logic Apps.

Primary reference

Review the official source

Customize alert notifications by using Logic Apps - Azure Monitor | Microsoft Learn · Verified September 17, 2026

Open official reference ↗
Plan the next step

Need help applying this guidance safely?

DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.

Talk with DSE