In PR #19878 the AzureRM monitor_activity_log_alert resource added support for granular service_health definitions. Outside of the UI, there is no obvious way of getting a list of inputs for the services parameter. The Azure portal uses an undocumented (AFAICT) API in the Microsoft.ResourceHealth provider to list supported services.
➜ az rest --method GET --url https://management.azure.com/providers/Microsoft.ResourceHealth/metadata/supportedServices/\?api-version\=2018-07-01 | jq '.properties.supportedValues[] .displayName'
"API Management"
"Action Groups"
"Activity Logs & Alerts"
"Advisor"
"Alerts"
<snip>