Scheduled query rule should have at least one scope

High Azure General scheduledqueryrules-scheduled-query-rule-least

Applies to

Microsoft.Insights/scheduledQueryRules

What CGPulse checks

A resource passes this rule when scopesCount must be one of [1,2,3,4,5,6,7,8,9,10]. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure at least one scope to define which resources are monitored. In Azure Portal: Monitor > Alerts > select rule > configure scope. See: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-log-alert-rule

CLI

az monitor scheduled-query show --ids "{id}" --query "scopes" -o json

Bicep

resource sqr 'Microsoft.Insights/scheduledQueryRules@2023-03-15-preview' = {{
  name: '{name}'
  location: resourceGroup().location
  properties: {{
    enabled: true
    scopes: [
      '<resource-id>'
    ]
    evaluationFrequency: 'PT5M'
    windowSize: 'PT5M'
    severity: 3
    criteria: {{
      allOf: [
        {{
          query: '<kql-query>'
          timeAggregation: 'Count'
          operator: 'GreaterThan'
          threshold: 0
        }}
      ]
    }}
  }}
}}

Terraform

resource "azurerm_monitor_scheduled_query_rules_alert_v2" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  scopes              = ["<resource-id>"]
  evaluation_frequency = "PT5M"
  window_duration      = "PT5M"
  severity             = 3
  criteria {
    query                   = "<kql-query>"
    time_aggregation_method = "Count"
    operator                = "GreaterThan"
    threshold               = 0
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan