How can I more simply update an AzActivityLogAlert ActionGroup?

I'm using a PaaS system that comes preconfigured on Azure with a large number of alerts. I want to update these alerts with an Azure Az Powershell v14 script by adding an Action Group to them, to get direct notifications of problems.

I can access these alerts using Get-AzActivityLogAlert and loop through the ActionGroup property to check if the AG already exists. However, there's no update/set command, only New-AzActivityLogAlert (which the docs says can create or update).

My current approach is to rebuild ActionGroup and Tags from Get-AzActivityLogAlert, and then plug these values into New-AzActivityLogAlert as follows:

$newActionGroups = $rule.ActionGroup            
$newActionGroups += New-AzActivityLogAlertActionGroupObject -Id $myAGID

$tagsHash = @{}
$rule.Tag.AdditionalProperties.GetEnumerator() | ForEach-Object {
    $tagsHash[$_.Key] = $_.Value
}

New-AzActivityLogAlert `
    -ResourceGroupName $tmpGroup `
    -Name $rule.Name `
    -Action $newActionGroups `
    -Condition $rule.ConditionAllOf `
    -Scope $rule.Scope `
    -Location $rule.Location `
    -Description $rule.Description `
    -Enabled $true `
    -Tag $tagsHash

This seems to add the new Action Group successfully, but it requires rebuilding the Tag property from one type (provided by Get-AzActivityLogAlert) into a type compatible with the New-AzActivityLogAlert command.

I'm also worried about losing other fields or data by over writing them with the New-AzActivityLogAlert command. For example, my first attempt was missing the -Tag flag, so I lost all my tags.

For metric alerts I just did something like this:

Get-AzMetricAlertRuleV2 -ResourceGroupName $tmpGroup -Name $rule.Name | Add-AzMetricAlertRuleV2 -ActionGroup $newActionGroups

This seems much safer and simpler. Is it possible to do something similar for the log alerts?

Solution

You can use the script below to create new Action Group to an existing Activity Log Alert while preserving its existing tags, conditions, and settings.

$resourceGroupName = "venkat-RG"
$alertName = "my-activity-log-alert"
$emailAddress = "dummy@contoso.com"

$emailReceiver = New-AzActionGroupEmailReceiverObject -Name "AlertEmail" -EmailAddress $emailAddress


$actionGroup = New-AzActionGroup -Name "demo-actiongrouptest" -ResourceGroupName $resourceGroupName -Location "Global" -EmailReceiver $emailReceiver -GroupShortName "SEGrp"

$actionGroupId = $actionGroup.Id
$actionGroupObj = New-AzActivityLogAlertActionGroupObject -Id $actionGroupId -WebhookProperty @{}


$existingAlert = Get-AzActivityLogAlert -ResourceGroupName $resourceGroupName -Name "Storage account key generation failed"


$existingAGIds = $existingAlert.Action | ForEach-Object { $_.Id }
if ($existingAGIds -notcontains $actionGroupId) {
    $updatedActions = @()
    foreach ($ag in $existingAlert.Action) {
        $updatedActions += New-AzActivityLogAlertActionGroupObject -Id $ag.Id
    }
    $updatedActions += $actionGroupObj
} else {
    $updatedActions = $existingAlert.Action
}

$tagsHash = @{}
$existingAlert.Tag.AdditionalProperties.GetEnumerator() | ForEach-Object {
    $tagsHash[$_.Key] = $_.Value
}
new Action Group attached
New-AzActivityLogAlert -ResourceGroupName $resourceGroupName -Name $alertName -Location $existingAlert.Location -Scope $existingAlert.Scope -Condition $existingAlert.ConditionAllOf -Action $updatedActions -Description $existingAlert.Description -Enabled $existingAlert.Enabled -Tag $tagsHash
Write-Output "Action Group successfully created and attached to Activity Log Alert '$alertName'."

Output: