Microsoft.Insights/metricAlerts/delete
Azure
Microsoft.Insights/metricAlerts/delete
Event
Removes the specified metric alert rule. Metric collection and historical metric data are separate from the rule; deletion does not by itself disable either.
Security Context
Unauthorized removal can impair defensive alerting (T1685). Approved cleanup is common. A CPU-related rule name does not demonstrate cryptocurrency mining or identify the actual threshold and resources.
Log Source
Azure Activity Log, Administrative category, with operationName.value: Microsoft.Insights/metricAlerts/delete. Inspect status/subStatus and related records; asynchronous acceptance is not final resource-state evidence. Request bodies are optional and export-dependent.
Key Fields
| Field | Investigation value |
|---|---|
caller, claims, authorization | Initiating identity and recorded authorization context; corroborate effective permissions. |
resourceId, correlationId | Target and related operation records. |
status, subStatus | Outcome and asynchronous acceptance versus completion. |
properties.requestbody, httpRequest | Configuration or command and endpoint when present; these fields are not guaranteed. |
What to Investigate
- Confirm the recorded outcome and compare actor, target, and timing with the approved workflow.
- Recover monitored scopes, metric criteria, evaluation settings, enabled state, and actions.
- Verify approved changes and any overlapping or replacement alerts.
- Compare later metrics and workload evidence with actual alert coverage; do not invent a subsequent malicious workload.
Sample Event
Synthetic scenario. The sample deletes phoenix-vm-cpu-spike-alert. No prior rule definition or subsequent workload activity is shown.
Exact field presence, modified-property names, payload nesting, and timestamp formatting remain unverified against captured logs. Names and illustrative identifiers do not prove intent or downstream activity.
{ "authorization": { "action": "Microsoft.Insights/metricAlerts/delete", "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.Insights/metricAlerts/phoenix-vm-cpu-spike-alert" }, "caller": "draco@fantasticlogs.cloud", "channels": "Operation", "claims": { "aud": "https://management.core.windows.net/", "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/", "iat": "1776592800", "nbf": "1776592800", "exp": "1776681600", "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "appidacr": "0", "ipaddr": "203.0.113.66", "name": "Draco Malfoy", "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010", "puid": "1003200000000666", "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001", "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud", "http://schemas.microsoft.com/identity/claims/wids": "e8611ab8-c189-46e8-94e1-60213ab1f814", "uti": "metricDel201ExampleUt", "ver": "1.0" }, "correlationId": "90000000-0000-4000-8000-000011111101", "description": "", "eventDataId": "90000000-0000-4000-8000-000011111110", "eventName": { "value": "EndRequest", "localizedValue": "End request" }, "category": { "value": "Administrative", "localizedValue": "Administrative" }, "eventTimestamp": "2026-04-15T17:41:33.7218845Z", "level": "Informational", "operationId": "90000000-0000-4000-8000-000011111111", "operationName": { "value": "Microsoft.Insights/metricAlerts/delete", "localizedValue": "Delete metricAlerts" }, "resourceGroupName": "rg-phoenix-dr", "resourceProviderName": { "value": "Microsoft.Insights", "localizedValue": "Microsoft Insights" }, "resourceType": { "value": "Microsoft.Insights/metricAlerts", "localizedValue": "Microsoft.Insights/metricAlerts" }, "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.Insights/metricAlerts/phoenix-vm-cpu-spike-alert", "status": { "value": "Succeeded", "localizedValue": "Succeeded" }, "subStatus": { "value": "OK", "localizedValue": "OK (HTTP Status Code: 200)" }, "submissionTimestamp": "2026-04-15T17:41:34.1102554Z", "subscriptionId": "20000000-0000-4000-8000-000000000001", "tenantId": "10000000-0000-4000-8000-000000000001", "properties": { "statusCode": "OK", "serviceRequestId": null, "eventCategory": "Administrative", "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-phoenix-dr/providers/Microsoft.Insights/metricAlerts/phoenix-vm-cpu-spike-alert", "message": "Microsoft.Insights/metricAlerts/delete", "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001" }, "relatedEvents": []}Sources
MITRE ATT&CK Mapping
Tactics: Defense Impairment
Techniques:
- T1685 — Disable or Modify Tools — Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping spec...