Examkin

Question

Difficulty: MediumAzure Monitor Alerts and Action Groups

An administrator configures an Azure Monitor action group to send email notifications to the members of a custom Azure subscription role named Ops-Admin. The custom role is assigned to a Microsoft Entra ID security group named Ops-Group. Several users are members of Ops-Group, but none of them are directly assigned the custom role. When an alert triggers, none of the members of Ops-Group receive the email notifications. What should you do to ensure the members receive the emails?

  1. A
    Modify the action group configuration to target the Object ID of the security group directly.
  2. B
    Configure an alert processing rule to forward the alerts to the security group.
  3. Assign the custom role directly to the individual users rather than the security group.Answer
  4. D
    Enable the Common Alert Schema setting on the action group action.

Answer

Assign the custom role directly to the individual users rather than the security group.
The correct option is to assign the custom role directly to the individual users. The Email Azure Resource Manager Role action in Azure Monitor action groups only sends email to Microsoft Entra ID users who are directly assigned the role. It does not support resolving members of Microsoft Entra ID groups that hold the role assignment.

Step-by-Step Solution

1
Analyze the action group configuration and the notification mechanism.
The action group is configured to send emails using the 'Email Azure Resource Manager Role' action.
This action type resolves role assignments at the subscription scope to find email addresses.
2
Identify limitations of the Email Azure Resource Manager Role action.
Azure Monitor only sends emails to users with direct role assignments. It does not traverse group memberships to find users who inherit the role.
This is a designed limitation of the Azure Monitor alerting platform to prevent excessive nested group resolution overhead.
3
Determine the solution to bypass this limitation.
Assigning the role directly to the individual users ensures Azure Monitor resolves their email addresses.
Direct role assignments are successfully processed by the Email Azure Resource Manager Role action.

Key Concept

Azure Monitor Action Group Role Receiver Limitations
Rate this question

Topics

Azure Monitor Alerts and Action Groups

More questions from this topic