---
title: '''Create Policy Assignment'' activity log alert should be configured'
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > 'Create Policy Assignment' activity log
  alert should be configured
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# 'Create Policy Assignment' activity log alert should be configured
 
## Description{% #description %}

Azure subscriptions should have an enabled activity log alert for the "Create Policy Assignment" (`Microsoft.Authorization/policyAssignments/write`) operation. This alert helps you detect unauthorized policy assignments. This rule passes when the alert is scoped to the subscription, uses the `Administrative` category, and does not filter on Level, Status, or Caller. It does not check whether an action group is attached to the alert, so confirm that separately.

## Remediation{% #remediation %}

Create a subscription-scoped activity log alert rule for the **Create Policy Assignment** signal and attach an action group. Do not filter the alert on Level, Status, or Caller. See [Create an activity log, service health, or resource health alert rule](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule).

## References{% #references %}

- [Create an activity log, service health, or resource health alert rule](https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-activity-log-alert-rule)
- [az monitor activity-log alert](https://learn.microsoft.com/en-us/cli/azure/monitor/activity-log/alert)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)