activitylog-alert.json

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "alertEmailAddress": {
      "type": "string",
      "metadata": {
        "description": "The email address to receive any alerts."
      }
    }
  },
  "variables": {
    "actionGroupName": "MyApplicationWarnings"
  },
  "resources": [
    {
      "name": "[variables('actionGroupName')]",
      "type": "Microsoft.Insights/actionGroups",
      "location": "global",
      "apiVersion": "2018-03-01",
      "properties": {
        "groupShortName": "Activity Log",
        "enabled": true,
        "emailReceivers": [
          {
            "name": "Administrator",
            "emailAddress": "[parameters('alertEmailAddress')]"
          }
        ]
      }
    },
    {
      "name": "ResourceGroupDeleted",
      "type": "Microsoft.Insights/activityLogAlerts",
      "location": "global",
      "apiVersion": "2017-04-01",
      "properties": {
        "description": "Resource Group Deleted",
        "enabled": true,
        "scopes": [
          "[subscription().id]"
        ],
        "condition": {
          "allOf": [
            {
              "field": "category",
              "equals": "Administrative"
            },
            {
              "field": "operationName",
              "equals": "Microsoft.Resources/subscriptions/resourceGroups/delete"
            }
          ]
        },
        "actions": {
          "actionGroups": [
            {
              "actionGroupId": "[resourceId('Microsoft.Insights/actionGroups', variables('actionGroupName'))]"
            }
          ]
        }
      }
    },
    {
      "name": "FailedDeployment",
      "type": "Microsoft.Insights/activityLogAlerts",
      "location": "global",
      "apiVersion": "2017-04-01",
      "properties": {
        "description": "Failed ARM Deployment",
        "enabled": true,
        "scopes": [
          "[resourceGroup().id]"
        ],
        "condition": {
          "allOf": [
            {
              "field": "category",
              "equals": "Administrative"
            },
            {
              "field": "resourceType",
              "equals": "Microsoft.Resources/deployments"
            },
            {
              "field": "status",
              "equals": "Failed"
            }
          ]
        },
        "actions": {
          "actionGroups": [
            {
              "actionGroupId": "[resourceId('Microsoft.Insights/actionGroups', variables('actionGroupName'))]"
            }
          ]
        }
      }
    }
  ]
}