Alerting can be enabled for:

• specific actions (example: vm deleted, adding new rules to users)
• service health events

---

references:

MS Learn

activity log alerts have their own attributes:

• Category: Administrative, service health, autoscale, policy, or recommendation
• Scope: Resource level, resource group level, or subscription level
• Resource group: Where the alert rule is saved
• Resource type: Namespace for the target of the alert
• Operation name: Operation name
• Level: Verbose, informational, warning, error, or critical
• Status: Started, failed, or succeeded
• Event initiated by: Email address or Microsoft Entra identifier (known as the “caller”) for the user