---
title: '''Delete SQL Server Firewall Rule'' activity log alert should be configured'
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > 'Delete SQL Server Firewall Rule'
  activity log alert should be configured
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# 'Delete SQL Server Firewall Rule' activity log alert should be configured
 
## Description{% #description %}

Azure subscriptions should have an enabled activity log alert for the "Delete SQL Server Firewall Rule" (`Microsoft.Sql/servers/firewallRules/delete`) operation. This alert helps you detect deletions of SQL Server firewall rules. This rule passes when the alert is scoped to the subscription, uses the `Administrative` category, and does not filter on Level, Status, or Caller. It does not check whether an action group is attached to the alert, so confirm that separately.

## Remediation{% #remediation %}

Create a subscription-scoped activity log alert rule for the **Delete SQL Server Firewall Rule** signal and attach an action group. Do not filter the alert on Level, Status, or Caller. See [Create an activity log, service health, or resource health alert rule](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule).

## References{% #references %}

- [Create an activity log, service health, or resource health alert rule](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule)
- [az monitor activity-log alert](https://learn.microsoft.com/en-us/cli/azure/monitor/activity-log/alert)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)