Azure Compliance ControlsAzure Monitor
Azure subscriptions should have an Activity Log Alert configured for Delete Policy Assignment
Create an activity log alert for the Delete Policy Assignment event. Azure Monitor Activity log alerts should cover policy assignment deletions using the Microsoft.Authorization/policyAssignments/delete operation at subscription scope.
What this control checks
Subscription has an Activity Log alert for Microsoft.Authorization/policyAssignments/delete.
Framework mappings
The clauses this control is mapped to in each framework.
- CC2.1 COSO Principle 13: The entity obtains or generates and uses relevant, quality information to support the functioning of internal control
- CC5.2 COSO Principle 11: The entity also selects and develops general control activities over technology to support the achievement of objectives
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures
- A.8.16 Monitoring activities
- 2 Risk management policy
- 3 Incident handling
- 4 Business continuity and crisis management
- 6 Security in network and information systems acquisition, development and maintenance
- 7 Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
1 more clause
- 11 Access control
- 7.1.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
- 6.1.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
RBI Cyber Security Framework for UCBs
- Annex I (7.4)
- AM-09.03AC Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.
- AM-09.04AC Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need for protection.
- DEV-08.02B The configuration of these system components ensures that all changes to system components in the production environment are recorded and can be traced back to the individuals or system components contributing to their development, deployment or implementation.
- HR-03.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.
- IAM-03.01AC The cloud service provider monitors the context of authentication attempts, e.g. IP addresses, the date and time or the device used, and flags suspicious events to authorised persons, as relevant.
16 more clauses
- IAM-06.05B The logged information is automatically monitored for defined events that may indicate misuse.
- IAM-06.06B When such an event is identified, the responsible personnel is automatically informed so that they can promptly assess whether misuse has occurred and take corresponding action.
- OIS-04.02AC Any deviations identified during monitoring are addressed through timely and appropriate remediation measures.
- OIS-05.01B The cloud service provider collects information from selected internal and external sources to gain a comprehensive view of the threat landscape that lead to cybersecurity risks.
- OIS-05.03B The threat intelligence insights are included in the risk management process (cf. OIS-07 and OIS-08) to ensure that the current internal and external threats are reflected in risk handling measures.
- OIS-08.07B The cloud service provider monitors the evolution of the risk and reviews the risk assessments accordingly.
- OPS-05.01B System components under the cloud service provider's responsibility that are used to operate the cloud service in the production environment are configured with malware protection according to the policies and instructions.
- OPS-05.03AC The configuration of the protection mechanisms is monitored automatically.
- OPS-11.02AC Cloud service derived data, including log data, is taken into consideration in regulatory compliance assessments.
- OPS-13.01B The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management.
- OPS-13.02B The SIEM system can be deployed within the cloud environment or externally and shall include the following capabilities: - Standardisation of log data;- Automated analysis to identify and correlate potential security incidents;- Capabilities to detect unusual behaviour and potential...
- OPS-26.01AS System components in the cloud service provider's area of responsibility are automatically monitored for compliance with hardening specifications.
- OPS-26.06B Any deviations from these specifications are promptly reported to the appropriate departments for immediate assessment and action.
- PSS-04.01B The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the...
- SIM-03.06B All documents and evidence that provide details on security incidents related to the cloud service are archived in a way that could be used as evidence in court. Security mechanisms and processes for protecting all the information about security incidents related to the cloud service...
- SIM-03.07B The analysis process also ensures traceability of the entire kill chain of a security incident.
- 5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
- 5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
- 5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
- 5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
- 5.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
- 6.2.2 Ensure that Activity Log Alert exists for Delete Policy Assignment
- 164.308(a)(1)(ii)(D): Administrative Safeguards
- 164.312(b) Audit controls
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
monitor_log_alert_delete_policy_assignment - Powerpipe Control:
azure_compliance.control.monitor_log_alert_delete_policy_assignment - Prowler Check:
monitor_alert_delete_policy_assignment
Last reviewed: 2026-10-13