---
title: Create and manage action groups in Azure Monitor
description: Find out how to create and manage action groups. Learn about notifications and actions that action groups enable, such as email, webhooks, and Azure functions.
ms.topic: how-to
ms.reviewer: jagummersall
ms.date: 07/21/2026
ms.custom: references_regions, devx-track-arm-template, has-azure-ad-ps-ref, azure-ad-ref-level-one-done
---
# Action groups
When Azure Monitor data indicates a potential issue in your infrastructure or application, it triggers an alert. To ensure timely response, you can attach action groups to these alerts, which are collections of notification preferences and automated actions.
Action groups define who gets notified and what actions are taken when an alert fires. Notification types include voice call, SMS, push notifications, and email. Automated actions can trigger a webhook, an [Azure Function](/azure/azure-functions/functions-overview), or a Logic Apps workflow that posts a message to **Microsoft Teams**. Use action groups across services like Azure Monitor, [Azure Service Health](/azure/service-health/overview), and [Azure Advisor](/azure/advisor/advisor-overview).
Each action is made up of:
* **Type**: The kind of notification or automation.
* **Name**: A unique identifier within the action group.
* **Details**: Specific configuration based on the action type.
This article shows you how to create and manage action groups.
## Overview
### Global availability and resilience
Global requests from clients can be processed by action group services in any region. If one region of the action group service is down, the traffic is automatically routed and processed in other regions. As a global service, an action group helps provide a disaster recovery solution.
> [!NOTE]
> Regional requests rely on availability zone redundancy to meet privacy requirements and offer a similar disaster recovery solution.
### Reusability and execution
* You can add up to five action groups to a single alert rule.
* Action groups are executed concurrently, in no specific order.
* Multiple alert rules can use the same action group.
* Action Groups are defined by the unique set of actions and the users to be notified.
**Example:** To notify User1, User2 and User3 by email for two different alert rules, you only need to create one action group and apply it to both alert rules.
## Global and regional action group processing
When you create an action group, you select a processing region. The region determines where the action group is stored and processed.
> [!NOTE]
> Service Health Alerts are only supported in public clouds within the global region. For Action groups to properly function in response to a Service Health Alert, the region of the action group must be set to *Global*.
| Option | Behavior |
| ------ | -------- |
| Global | The action groups service decides where to store the action group. The action group is persisted in at least two regions to ensure regional resiliency. Processing of actions may be done in any [geographic region](https://azure.microsoft.com/explore/global-infrastructure/geographies/#overview).
Voice, SMS, and email actions performed as the result of [service health alerts](../../service-health/alerts-activity-log-service-notifications-portal.md) are resilient to Azure live-site incidents. |
| Regional | The action group is stored within the selected region. The action group is [zone-redundant](/azure/reliability/availability-zones-service-support). Use this option if you want to ensure that the processing of your action group is performed within a specific [geographic boundary](https://azure.microsoft.com/explore/global-infrastructure/geographies/#overview).
You can select one of these regions for regional processing of action groups:
• East US
• West US
• East US2
• West US2
• South Central US
• North Central US
• Sweden Central
• Germany West Central
• India Central
• India South
We're continually adding more regions for regional data processing of action groups. |
## Notification types
An action group can contain one or more notifications. The following table describes the available notification types that you can configure.
| Notification type | Description | Fields |
|-------------------|-------------|--------|
| Email Azure Resource Manager role | Send an email to the subscription members, based on their role.
See [Email](#email-azure-resource-manager). | Enter the primary email address configured for the Microsoft Entra user. See [Email](#email-azure-resource-manager).
ARM Role Email addresses don't require OTP verification. |
| Email | Ensure that your email filtering and any malware or spam prevention services are configured appropriately.
Emails are sent from the following email addresses:
• azure-noreply@microsoft.com
• azureemail-noreply@microsoft.com
• alerts-noreply@mail.windowsazure.com | Enter the email where the notification should be sent.
Email addresses must be verified through a one-time passcode (OTP) within 30 minutes of saving the action group. This verification persists across all past and future action groups within the same tenant. If the passcode expires, open the action group and select Resend. An unverified receiver can't receive alert or test notifications after enforcement is active.|
| SMS | SMS notifications support bi-directional communication. The SMS contains the following information:
• Shortname of the action group this alert was sent to
• The title of the alert.
A user can respond to an SMS to:
• Unsubscribe from all SMS alerts for all action groups or a single action group.
• Resubscribe to alerts
• Request help.
For more information about supported SMS replies, see [SMS replies](#sms-replies). | Enter the **Country code** and the **Phone number** for the SMS recipient. If you can't select your country/region code in the Azure portal, SMS isn't supported for your country/region. If your country/region code isn't available, you can vote to have your country/region added at [Share your ideas](https://feedback.azure.com/d365community/idea/e527eaa6-2025-ec11-b6e6-000d3a4f09d0). As a workaround until your country is supported, configure the action group to call a webhook to a third-party SMS provider that supports your country/region. |
| Azure app push notifications | Send notifications to the [Azure mobile app](https://azure.microsoft.com/features/azure-portal/mobile-app/). | In the **Azure account email** field, enter the email address that you use as your account ID when you configure the Azure mobile app. |
| Voice | Voice notification. | Enter the **Country code** and the **Phone number** for the recipient of the notification. If you can't select your country/region code in the Azure portal, voice notifications aren't supported for your country/region. If your country/region code isn't available, you can vote to have your country/region added at [Share your ideas](https://feedback.azure.com/d365community/idea/e527eaa6-2025-ec11-b6e6-000d3a4f09d0). As a workaround until your country is supported, configure the action group to call a webhook to a third-party voice call provider that supports your country/region. |
## Action types
An action group can contain one or more automated actions. The following table describes the available action types.
| Action type | Details |
|-------------|---------|
| Automation Runbook | Use Automation Runbook to automate tasks based on metrics. For example, shut down resources when a certain threshold in the associated budget is met. For information about limits on Automation runbook payloads, see [Automation limits](/azure/azure-resource-manager/management/azure-subscription-service-limits#automation-limits). |
| Event hubs | An Event Hubs action publishes notifications to Event Hubs. It's the only action type that supports [Azure Private Link](/azure/event-hubs/private-link-service) and [network security perimeter (NSP)](/azure/private-link/network-security-perimeter-concepts). For more information about Event Hubs, see [Azure Event Hubs—A big data streaming platform and event ingestion service](/azure/event-hubs/event-hubs-about). You can subscribe to the alert notification stream from your event receiver. *Event hub supports cross-tenant support up to api version _2023-09-01-preview_ |
| Functions | Calls an existing HTTP trigger endpoint in functions. For more information, see [Azure Functions](/azure/azure-functions/functions-get-started).
When you define the function action, the function's HTTP trigger endpoint and access key are saved in the action definition, for example, `https://azfunctionurl.azurewebsites.net/api/httptrigger?code=`. If you change the access key for the function, you must remove and re-create the function action in the action group.
Your endpoint must support the HTTP POST method.
The function must have access to the storage account. If it doesn't have access, keys aren't available and the function URI isn't accessible.
[Learn about restoring access to the storage account](/azure/azure-functions/functions-recover-storage-account). |
| ITSM | An ITSM action requires an ITSM connection. To learn how to create an ITSM connection, see [ITSM integration](./itsmc-overview.md). |
| Logic apps | You can use [Azure Logic Apps](/azure/logic-apps/logic-apps-overview) to build integration workflows and customize alert notifications. For example, use a logic app to post an alert notification to a **Microsoft Teams** channel. For steps, see [Customize alert notifications by using Logic Apps](./alerts-logic-apps.md?tabs=send-teams-message#set-up-an-action). |
| Secure webhook | When you use a secure webhook action, you must use Microsoft Entra ID to secure the connection between your action group and your endpoint, which is a protected web API. See [Configure authentication for Secure webhook](#configure-authentication-for-secure-webhook). Secure webhook doesn't support basic authentication. If you're using basic authentication, use the Webhook action. |
| Webhook | If you use the webhook action, your target webhook endpoint must be able to process the various JSON payloads that different alert sources emit.
You can't pass security certificates through a webhook action. To use basic authentication, you must pass your credentials through the URI.
If the webhook endpoint expects a specific schema, for example, the Microsoft Teams schema, use the **Logic Apps** action type to manipulate the alert schema to meet the target webhook's expectations.
For information about the rules used for retrying webhook actions, see [Webhook](#webhook). |
## Create in the Azure portal
1. Go to the [Azure portal](https://portal.azure.com/).
1. Search for and select **Monitor**. The **Monitor** pane consolidates all your monitoring settings and data in one view.
1. Select **Alerts**, and then select **Action groups**.
:::image type="content" source="media/action-groups/manage-action-groups.png" lightbox="media/action-groups/manage-action-groups.png" alt-text="Screenshot of the Alerts page in the Azure portal with the action groups button highlighter.":::
1. Select **Create** from the top action bar.
1. Configure basic action group settings. In the **Project details** section:
* Select values for **Subscription** and **Resource group**.
* Select the region. For details about the differences between Global and Regional processing, see [Global and regional action group processing](#global-and-regional-action-group-processing).
The action group is saved in the subscription, region, and resource group that you select.
1. In the **Instance details** section, enter values for **Action group name** and **Display name**. The display name is used in place of a full action group name when the group is used to send notifications.
:::image type="content" source="media/action-groups/action-group-1-basics.png" lightbox="media/action-groups/action-group-1-basics.png" alt-text="Screenshot that shows the Create action group dialog. Values are visible in the Subscription, Resource group, Action group name, and Display name boxes.":::
1. Configure notifications. Select **Next: Notifications**, or select the **Notifications** tab at the top of the page.
1. Define a list of notifications to send when an alert is triggered.
1. For each notification:
1. Select the **Notification type**, and then fill in the appropriate fields for that notification. For available options, see [Notification types](#notification-types).
1. Select if you want to enable the **Common alert schema**. The common alert schema is a single extensible and unified alert payload that can be used across all the alert services in Azure Monitor. For more information about the common schema, see [Common alert schema](./alerts-common-schema.md).
:::image type="content" source="~/reusable-content/ce-skilling/azure/media/azure-monitor/action-group-2-notifications.png" lightbox="~/reusable-content/ce-skilling/azure/media/azure-monitor/action-group-2-notifications.png" alt-text="Screenshot that shows the Notifications tab of the Create action group dialog. Configuration information for an email notification is visible.":::
1. Select **OK**.
1. Configure actions. Select **Next: Actions**. or select the **Actions** tab at the top of the page.
1. Define a list of actions to trigger when an alert is triggered. Select an action type and enter a name for each action. For available options, see [Action types](#action-types).
:::image type="content" source="media/action-groups/action-group-3-actions.png" lightbox="media/action-groups/action-group-3-actions.png" alt-text="Screenshot that shows the Actions tab of the Create action group dialog. Several options are visible in the Action type list.":::
1. (Optional) If you'd like to assign a key-value pair to the action group to categorize your Azure resources, select **Next: Tags** or the **Tags** tab. Otherwise, skip this step.
1. Select **Review + create** to review your settings. This step quickly checks your inputs to make sure you entered all required information. If there are issues, they're reported here. After reviewing the settings, select **Create** to create the action group.
> [!NOTE]
> When you configure an action to notify a person by email or SMS, they receive a confirmation indicating they were added to the action group. New email addresses receive a one-time passcode (OTP) validation request. Previously validated email addresses receive a standard notification email.
### Test an action group in the Azure portal
When you create or update an action group in the Azure portal, you can test the action group.
1. [Create an action group in the Azure portal](#create-in-the-azure-portal).
> [!NOTE]
> The action group must be created and saved before testing. If you're editing an existing action group, save the changes to the action group before testing.
1. On the **Action groups** page, select an action group, then select **Test** from the top action bar.
1. Select a sample type and the notification and action types that you want to test. Then select **Test**.
:::image type="content" source="media/action-groups/test-sample-action-group.png" lightbox="media/action-groups/test-sample-action-group.png" alt-text="Screenshot that shows the Test sample action group page with an email notification type and a webhook action type.":::
1. If you close the window or select **Back to test setup** while the test is running, the test is stopped, and you don't get test results.
:::image type="content" source="media/action-groups/stop-running-test.png" lightbox="media/action-groups/stop-running-test.png" alt-text="Screenshot that shows the Test Sample action group page. A dialog contains a Stop button and asks the user about stopping the test.":::
1. When the test is finished, a test status of either **Success** or **Failed** appears. If the test failed and you want to get more information, select **View details**.
:::image type="content" source="media/action-groups/test-sample-failed.png" lightbox="media/action-groups/test-sample-failed.png" alt-text="Screenshot that shows the Test sample action group page showing a test that failed.":::
You can use the information in the **Error details** section to understand the issue. Then you can edit, save changes, and test the action group again.
When you run a test and select a notification type, you get a message with "Test" in the subject. The tests provide a way to check that your action group works as expected before you enable it in a production environment. All the details and links in test email notifications are from a sample reference set.
### Use Managed Identity with Azure Action Groups (preview)
Azure Action Groups now support [Managed Identities](/azure/active-directory/managed-identities-azure-resources/overview) for secure, credential-free authentication when invoking downstream services. This feature is available now available in preview.
Perform the following steps to use existing managed identities in an action group:
1. Configure the action group to use the preferred identity for each action within the action group.
2. Ensure required roles are assigned to the selected identity.
3. Grant a managed identities access to a resource (action type) for the call to authenticate See [Use Azure portal to grant a managed identity access to a resource](/entra/identity/managed-identities-azure-resources/grant-managed-identity-resource-access-azure-portal).
:::image type="content" source="./media/action-groups/action-group-managed-identity.png" lightbox="./media/action-groups/action-group-managed-identity.png" alt-text="Screenshot showing the identity setting for an action in an action group.":::
#### Supported Action Types
The following table lists the action types that are supported with managed identity:
Action Type | Managed Identity Support | Role Assignment Name | Role ID
-------------------|---------------------------|------------------------------|-------------------------------------
Automation Runbook | Yes | Automation Contributor | f353d9bd-d4a6-484e-a77a-8050b599b867
Azure Function | Yes | Function App authorization (Microsoft Entra ID) | N/A
Event Hub | Yes | Azure Event Hubs Data Sender | 2b629674-e913-4c01-ae53-ef4638d8f975
ITSM | No | N/A | N/A
Logic App | Yes | Logic App Contributor | 87a39d53-fc1b-424a-814c-f7e04687dc9e
Secure Webhook | No | N/A | N/A
Webhook | No | N/A | N/A
> [!NOTE]
> If you configure managed identity using the Azure portal, role assignments will automatically be added to your identity. For PowerShell, CLI, or SDK configurations you must manually assign the roles.
### Role requirements for test action groups
The following table describes the role membership requirements that are needed for the *test actions* functionality:
| Role membership | Existing action group | Existing resource group and new action group | New resource group and new action group |
|-----------------------------------|-----------------------|----------------------------------------------|-----------------------------------------|
| Subscription contributor | Supported | Supported | Supported |
| Resource group contributor | Supported | Supported | Not applicable |
| Action group resource contributor | Supported | Not applicable | Not applicable |
| Azure Monitor contributor | Supported | Supported | Not applicable |
| Custom role 1 | Supported | Supported | Not applicable |
1 The custom role must have the **Microsoft.Insights/ActionGroups/*** permission added, which will also allow the user to update and delete the action group. To add restrictions so the user can only test the action group, add the following under the **JSON** tab for the custom role:
```json
{
"properties": {
"roleName": "",
"description": "",
"assignableScopes": [
"/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}"
],
"permissions": [
{
"actions": [
"Microsoft.Insights/ActionGroups/*"
],
"notActions": [
"Microsoft.Insights/ActionGroups/write",
"Microsoft.Insights/ActionGroups/delete"
],
"dataActions": [],
"notDataActions": []
}
]
}
}
```
> [!NOTE]
> * You can run a limited number of tests per time period. To check which limits apply to your situation, see [Azure Monitor service limits](../service-limits.md).
>
> * When you configure an action group in the portal, you can opt in or out of the common alert schema.
> * To find common schema samples for all sample types, see [Common alert schema definitions for Test Action Group](./alerts-common-schema-test-action-definitions.md).
> * To find noncommon schema alert definitions, see [Noncommon alert schema definitions for Test Action Group](./alerts-non-common-schema-definitions.md).
## Create with a Resource Manager template
You can use an [Azure Resource Manager template](/azure/azure-resource-manager/templates/syntax) to configure action groups. Using templates, you can automatically set up action groups that can be reused in certain types of alerts. These action groups ensure that all the correct parties are notified when an alert is triggered.
The basic steps are:
1. Create a template as a JSON file that describes how to create the action group.
1. Deploy the template by using [any deployment method](/azure/azure-resource-manager/templates/deploy-powershell).
### Action group Resource Manager templates
To create an action group by using a Resource Manager template, you create a resource of the type `Microsoft.Insights/actionGroups`. Then you fill in all related properties. Here are two sample templates that create an action group.
**Template 1**
This template describes how to create a Resource Manager template for an action group where the action definitions are hard-coded in the template.
Expand to view the template
```json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"actionGroupName": {
"type": "string",
"metadata": {
"description": "Unique name (within the Resource Group) for the Action group."
}
},
"actionGroupShortName": {
"type": "string",
"metadata": {
"description": "Short name (maximum 12 characters) for the Action group."
}
}
},
"resources": [
{
"type": "Microsoft.Insights/actionGroups",
"apiVersion": "2021-09-01",
"name": "[parameters('actionGroupName')]",
"location": "Global",
"properties": {
"groupShortName": "[parameters('actionGroupShortName')]",
"enabled": true,
"smsReceivers": [
{
"name": "contosoSMS",
"countryCode": "1",
"phoneNumber": "5555551212"
},
{
"name": "contosoSMS2",
"countryCode": "1",
"phoneNumber": "5555552121"
}
],
"emailReceivers": [
{
"name": "contosoEmail",
"emailAddress": "devops@contoso.com",
"useCommonAlertSchema": true
},
{
"name": "contosoEmail2",
"emailAddress": "devops2@contoso.com",
"useCommonAlertSchema": true
}
],
"webhookReceivers": [
{
"name": "contosoHook",
"serviceUri": "http://requestb.in/1bq62iu1",
"useCommonAlertSchema": true
},
{
"name": "contosoHook2",
"serviceUri": "http://requestb.in/1bq62iu2",
"useCommonAlertSchema": true
}
],
"SecurewebhookReceivers": [
{
"name": "contososecureHook",
"serviceUri": "http://requestb.in/1bq63iu1",
"useCommonAlertSchema": false
},
{
"name": "contososecureHook2",
"serviceUri": "http://requestb.in/1bq63iu2",
"useCommonAlertSchema": false
}
],
"eventHubReceivers": [
{
"name": "contosoeventhub1",
"subscriptionId": "replace with subscription id GUID",
"eventHubNameSpace": "contosoeventHubNameSpace",
"eventHubName": "contosoeventHub",
"useCommonAlertSchema": true
}
]
}
}
],
"outputs":{
"actionGroupId":{
"type":"string",
"value":"[resourceId('Microsoft.Insights/actionGroups',parameters('actionGroupName'))]"
}
}
}
```
**Template 2**
This template describes how to create a template that takes the webhook configuration information as input parameters when the template is deployed.
Expand to view the template
```json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"actionGroupName": {
"type": "string",
"metadata": {
"description": "Unique name (within the Resource Group) for the Action group."
}
},
"actionGroupShortName": {
"type": "string",
"metadata": {
"description": "Short name (maximum 12 characters) for the Action group."
}
},
"webhookReceiverName": {
"type": "string",
"metadata": {
"description": "Webhook receiver service Name."
}
},
"webhookServiceUri": {
"type": "string",
"metadata": {
"description": "Webhook receiver service URI."
}
}
},
"resources": [
{
"type": "Microsoft.Insights/actionGroups",
"apiVersion": "2021-09-01",
"name": "[parameters('actionGroupName')]",
"location": "Global",
"properties": {
"groupShortName": "[parameters('actionGroupShortName')]",
"enabled": true,
"smsReceivers": [
],
"emailReceivers": [
],
"webhookReceivers": [
{
"name": "[parameters('webhookReceiverName')]",
"serviceUri": "[parameters('webhookServiceUri')]",
"useCommonAlertSchema": true
}
]
}
}
],
"outputs":{
"actionGroupResourceId":{
"type":"string",
"value":"[resourceId('Microsoft.Insights/actionGroups',parameters('actionGroupName'))]"
}
}
}
```
## Edit or delete an existing group
After you create an action group, you can view it in the portal:
1. Go to the [Azure portal](https://portal.azure.com).
1. From the **Monitor** page, select **Alerts**.
1. Select **Action groups**.
1. Select the action group that you want to manage. You can:
* Add, edit, or remove actions.
* Delete the action group.
## Service limits for notifications
A phone number or email can be included in action groups in many subscriptions. Azure Monitor uses rate limiting to suspend notifications when too many notifications are sent to a particular phone number, email address, or device. Rate limiting ensures that alerts are manageable and actionable.
Rate limiting applies to SMS, voice, push, and email notifications. All other notification actions aren't rate limited. Rate limiting applies across all subscriptions. Rate limiting is applied as soon as the threshold is reached, even if messages are sent from multiple subscriptions. When an email address is rate limited, a notification is sent to communicate that rate limiting was applied and when the rate limiting expires.
For information about rate limits, see [Azure Monitor service limits](../service-limits.md).
## Email Azure Resource Manager
When you use Azure Resource Manager for email notifications, you can send email to the members of a subscription's role. Email is sent to Microsoft Entra ID **user** or **group** members of the role. This includes support for roles assigned through Azure Lighthouse.
> [!NOTE]
> Action Groups only support emailing the following roles: Owner, Contributor, Reader, Monitoring Contributor, Monitoring Reader.
If your primary email doesn't receive notifications, configure the email address for the Email Azure Resource Manager role:
1. In the Azure portal, go to **Microsoft Entra ID**.
1. Select **Users** in the left-hand menu to show a list of all users.
1. Select the user whose *primary email* you want to review.
:::image type="content" source="media/action-groups/active-directory-user-profile.png" lightbox="media/action-groups/active-directory-user-profile.png" alt-text="Screenshot that shows the Azure portal All users page. Information about one user is visible but is indecipherable." border="true":::
1. In the user profile under **Properties**, look at **Contact info** for an **Email** value. If it's blank:
1. At the top of the page, select **Edit properties**.
1. Enter an email address.
1. At the top of the page, select **Save**.
:::image type="content" source="media/action-groups/active-directory-add-primary-email.png" lightbox="media/action-groups/active-directory-add-primary-email.png" alt-text="Screenshot that shows a user profile page in the Azure portal. The Edit button and the Email box are called out." border="true":::
You may have a limited number of email actions per action group. To check which limits apply to your situation, see [Azure Monitor service limits](../service-limits.md).
When you set up the Resource Manager role:
* Assign an entity of type **User** or **Group** to the role.
* Make the assignment at the **subscription** level.
* Make sure an email address is configured for the user in their **Microsoft Entra profile**.
> [!NOTE]
> It can take up to 24 hours for a customer to start receiving notifications after they add a new Azure Resource Manager role to their subscription.
## SMS
SMS notifications in Azure Monitor action groups support bi-directional communication. The SMS contains the short name of the action group and the title of the alert. Users can respond to an SMS to unsubscribe, resubscribe, or request help.
You might have a limited number of SMS actions per action group.
* For information about rate limits, see [Azure Monitor service limits](../service-limits.md).
* For more details about SMS notification configuration, see [Create an action group in the Azure portal](#create-in-the-azure-portal).
> [!NOTE]
> If you can't select your country/region code in the Azure portal, SMS isn't supported for your country/region. If your country/region code isn't available, you can vote to have your country/region added at [Share your ideas](https://feedback.azure.com/d365community/idea/e527eaa6-2025-ec11-b6e6-000d3a4f09d0). In the meantime, as a workaround, configure your action group to call a webhook to a third-party SMS provider that offers support in your country/region.
### SMS replies
These replies are supported for SMS notifications. The recipient of the SMS can reply to the SMS with these values:
| REPLY | Description |
|-------------------------------------|-------------------------------------------------------------|
| DISABLE `` | Disables further SMS from the Action Group |
| ENABLE `` | Re-enables SMS from the Action Group |
| STOP | Disables further SMS from all Action Groups |
| START | Re-enables SMS from all Action Groups |
| HELP | A response is sent to the user with a link to this article. |
> [!NOTE]
> If a user unsubscribed from SMS alerts and is then added to a new action group, they receive SMS alerts for that new action group, but remain unsubscribed from all previous action groups.
You might have a limited number of Azure app actions per action group.
### Countries/Regions with SMS notification support
Expand to view list
| Country code | Country |
|:-------------|:----------------------------------------|
| 61 | Australia |
| 43 | Austria |
| 32 | Belgium |
| 55 | Brazil |
| 1 | Canada |
| 56 | Chile |
| 86 | China |
| 420 | Czech Republic |
| 45 | Denmark |
| 372 | Estonia |
| 358 | Finland |
| 33 | France |
| 49 | Germany |
| 852 | Hong Kong Special Administrative Region |
| 91 | India |
| 353 | Ireland |
| 972 | Israel |
| 39 | Italy |
| 81 | Japan |
| 352 | Luxembourg |
| 60 | Malaysia |
| 52 | Mexico |
| 31 | Netherlands |
| 64 | New Zealand |
| 47 | Norway |
| 351 | Portugal |
| 1 | Puerto Rico |
| 40 | Romania |
| 7 | Russia |
| 65 | Singapore |
| 27 | South Africa |
| 82 | South Korea |
| 34 | Spain |
| 41 | Switzerland |
| 886 | Taiwan |
| 971 | UAE |
| 44 | United Kingdom |
| 1 | United States |
## Voice
You might have a limited number of voice actions per action group. For important information about rate limits, see [Azure Monitor service limits](../service-limits.md).
> [!NOTE]
> If you can't select your country/region code in the Azure portal, voice calls aren't supported for your country/region. If your country/region code isn't available, you can vote to have your country/region added at [Share your ideas](https://feedback.azure.com/d365community/idea/e527eaa6-2025-ec11-b6e6-000d3a4f09d0). In the meantime, as a workaround, configure your action group to call a webhook to a third-party voice call provider that offers support in your country/region. If a country is marked with an asterisk (\*), calls come from a USA based phone number.
### Countries/Regions with Voice notification support
Expand to view list
| Country code | Country |
|:-------------|:----------------------|
| 61 | Australia |
| 43 | Austria |
| 32 | Belgium |
| 55 | Brazil |
| 1 | Canada |
| 56 | Chile |
| 86 | China* |
| 420 | Czech Republic |
| 45 | Denmark |
| 372 | Estonia |
| 358 | Finland |
| 33 | France |
| 49 | Germany |
| 852 | Hong Kong* |
| 91 | India* |
| 353 | Ireland |
| 972 | Israel |
| 39 | Italy* |
| 81 | Japan* |
| 352 | Luxembourg |
| 60 | Malaysia |
| 52 | Mexico |
| 31 | Netherlands |
| 64 | New Zealand |
| 47 | Norway |
| 351 | Portugal |
| 40 | Romania* |
| 7 | Russia* |
| 65 | Singapore |
| 27 | South Africa |
| 82 | South Korea |
| 34 | Spain |
| 46 | Sweeden |
| 41 | Switzerland |
| 886 | Taiwan* |
| 971 | United Arab Emirates* |
| 44 | United Kingdom |
| 1 | United States |
For information about pricing for supported countries/regions, see [Azure Monitor pricing](https://azure.microsoft.com/pricing/details/monitor/).
## Webhook
> [!NOTE]
> If you use the webhook action, your target webhook endpoint must be able to process the various JSON payloads that different alert sources emit. The webhook endpoint must also be publicly accessible. You can't pass security certificates through a webhook action. To use basic authentication, you must pass your credentials through the URI. If the webhook endpoint expects a specific schema, for example, the Microsoft Teams schema, use the Logic Apps action to transform the alert schema to meet the target webhook's expectations.
>
> Action groups support two webhook types: **Webhook** for endpoints using basic auth via URI, and **Secure webhook** for endpoints protected by Microsoft Entra ID service principal authentication.
### Webhook retry behavior
Webhook action groups generally follow these rules when called:
* When a webhook is invoked, if the first call fails, it's retried at least 1 more time, and up to 5 times (5 retries) at various delay intervals (5, 20, 40 seconds).
| Attempts | Delay |
|---------------------|------------|
| Between 1st and 2nd | 5 seconds |
| Between 2nd and 3rd | 20 seconds |
| Between 3rd and 4th | 5 seconds |
| Between 4th and 5th | 40 seconds |
| Between 5th and 6th | 5 seconds |
* After retries attempted to call the webhook fail, no action group calls the endpoint for 15 minutes.
* The retry logic assumes that the call can be retried. The status codes 408, 429, 503, 504, or HttpRequestException, WebException, `TaskCancellationException` allow for the call to be retried.
### Configure authentication for Secure webhook
The secure webhook action authenticates to the protected API by using a Service Principal instance in the Microsoft Entra tenant of the *AZNS AAD Webhook* Microsoft Entra application. To make the action group work, this Microsoft Entra Webhook Service Principal must be added as a member of a role on the target Microsoft Entra application that grants access to the target endpoint.
For an overview of Microsoft Entra applications and service principals, see [Microsoft identity platform (v2.0) overview](/azure/active-directory/develop/v2-overview). Follow these steps to take advantage of the secure webhook functionality.
> [!NOTE]
> Basic authentication isn't supported for `SecureWebhook`. To use basic authentication, you must use `Webhook`.
If you use the webhook action, your target webhook endpoint must be able to process the various JSON payloads that different alert sources emit. If the webhook endpoint expects a specific schema, for example, the Microsoft Teams schema, use the Logic Apps action to transform the alert schema to meet the target webhook's expectations.
[!INCLUDE [Azure AD PowerShell deprecation note](~/reusable-content/msgraph-powershell/includes/aad-powershell-deprecation-note.md)]
1. Create a Microsoft Entra application for your protected web API. For more information, see [Protected web API: App registration](/azure/active-directory/develop/scenario-protected-web-api-app-registration). Configure your protected API to be called by a daemon app and expose application permissions, not delegated permissions.
> [!TIP]
> Configure your protected web API to accept V2.0 access tokens. For more information about this setting, see [Microsoft Entra app manifest](/azure/active-directory/develop/reference-app-manifest#accesstokenacceptedversion-attribute).
1. To enable the action group to use your Microsoft Entra application, use the PowerShell script that follows this procedure.
> [!NOTE]
> * You must be assigned the [Microsoft Entra Application Administrator role](/azure/active-directory/roles/permissions-reference#all-roles) to run this script.
>
> * The service principal must be assigned an **owner role** of the Microsoft Entra application to be able to create, modify, or test the secure webhook action in the action group.
1. Configure the secure webhook action.
1. Copy the `$myApp.ObjectId` value that's in the script.
1. In the webhook action definition, in the **Object Id** box, enter the value that you copied.
:::image type="content" source="media/action-groups/action-groups-secure-webhook.png" lightbox="media/action-groups/action-groups-secure-webhook.png" alt-text="Screenshot that shows the Secured Webhook dialog in the Azure portal with the Object ID box." border="true":::
### Secure webhook PowerShell script
> [!NOTE]
>Prerequisites: [Install the Microsoft Graph PowerShell SDK](/powershell/microsoftgraph/installation?view=graph-powershell-1.0&preserve-view=true)
#### How to run
1. Copy and paste the following script to your machine.
1. Replace your `tenantId` and the `ObjectID` in your App Registration.
1. Save as *\*.ps1*
1. Open the PowerShell command from your machine and run the *\*.ps1* script.
Expand to view the script
```PowerShell
Write-Host "================================================================================================="
$scopes = "Application.ReadWrite.All"
$myTenantId = "<>"
$myMicrosoftEntraAppRegistrationObjectId = "<>"
$actionGroupRoleName = "ActionGroupsSecureWebhook"
$azureMonitorActionGroupsAppId = "461e8683-5575-4561-ac7f-899cc907d62a" # Required. Do not change.
Connect-MgGraph -Scopes $scopes -TenantId $myTenantId
Function CreateAppRole([string] $Name, [string] $Description)
{
$appRole = @{
AllowedMemberTypes = @("Application")
DisplayName = $Name
Id = New-Guid
IsEnabled = $true
Description = $Description
Value = $Name
}
return $appRole
}
$myApp = Get-MgApplication -ApplicationId $myMicrosoftEntraAppRegistrationObjectId
$myAppRoles = $myApp.AppRoles
$myActionGroupServicePrincipal = Get-MgServicePrincipal -Filter "appId eq '$azureMonitorActionGroupsAppId'"
Write-Host "App Roles before addition of new role.."
foreach ($role in $myAppRoles) { Write-Host $role.Value }
if ($myAppRoles.Value -contains $actionGroupRoleName)
{
Write-Host "The Action Group role is already defined. No need to redefine.`n"
# Retrieve the application again to get the updated roles
$myApp = Get-MgApplication -ApplicationId $myMicrosoftEntraAppRegistrationObjectId
$myAppRoles = $myApp.AppRoles
}
else
{
Write-Host "The Action Group role is not defined. Defining the role and adding it."
$newRole = CreateAppRole -Name $actionGroupRoleName -Description "This is a role for Action Group to join"
$myAppRoles += $newRole
Update-MgApplication -ApplicationId $myApp.Id -AppRole $myAppRoles
# Retrieve the application again to get the updated roles
$myApp = Get-MgApplication -ApplicationId $myMicrosoftEntraAppRegistrationObjectId
$myAppRoles = $myApp.AppRoles
}
$myServicePrincipal = Get-MgServicePrincipal -Filter "appId eq '$($myApp.AppId)'"
if ($myActionGroupServicePrincipal.DisplayName -contains "AzNS AAD Webhook")
{
Write-Host "The Service principal is already defined.`n"
Write-Host "The action group Service Principal is: " + $myActionGroupServicePrincipal.DisplayName + " and the id is: " + $myActionGroupServicePrincipal.Id
}
else
{
Write-Host "The Service principal has NOT been defined/created in the tenant.`n"
$myActionGroupServicePrincipal = New-MgServicePrincipal -AppId $azureMonitorActionGroupsAppId
Write-Host "The Service Principal is been created successfully, and the id is: " + $myActionGroupServicePrincipal.Id
}
# Check if $myActionGroupServicePrincipal is not $null before trying to access its Id property
# Check if the role assignment already exists
$existingRoleAssignment = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $myActionGroupServicePrincipal.Id | Where-Object { $_.AppRoleId -eq $myApp.AppRoles[0].Id -and $_.PrincipalId -eq $myActionGroupServicePrincipal.Id -and $_.ResourceId -eq $myServicePrincipal.Id }
# If the role assignment does not exist, create it
if ($null -eq $existingRoleAssignment) {
Write-Host "Doing app role assignment to the new action group Service Principal`n"
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $myActionGroupServicePrincipal.Id -AppRoleId $myApp.AppRoles[0].Id -PrincipalId $myActionGroupServicePrincipal.Id -ResourceId $myServicePrincipal.Id
} else {
Write-Host "Skip assigning because the role already existed."
}
Write-Host "myServicePrincipalId: " $myServicePrincipal.Id
Write-Host "My Azure AD Application (ObjectId): " $myApp.Id
Write-Host "My Azure AD Application's Roles"
foreach ($role in $myAppRoles) { Write-Host $role.Value }
Write-Host "================================================================================================="
```
## Migrate Runbook action from "Run as account" to "Run as Managed Identity"
> [!NOTE]
> Azure Automation *Run as account* was [retired](https://azure.microsoft.com/updates/azure-automation-runas-account-retiring-on-30-september-2023/) on 30 September 2023, which affects actions created with action type *Automation Runbook*. Existing actions linking to *Run as account* runbooks won't be supported after retirement. However, those runbooks would continue to execute until the expiry of "Run as" certificate of the Automation account.
To ensure you can continue using the runbook actions, you need to:
1. Edit the action group by adding a new action with action type *Automation Runbook* and choose the same runbook from the dropdown.
> [!NOTE]
> All 5 runbooks in the dropdown have been reconfigured at the backend to authenticate using Managed Identity instead of Run as account. System-assigned Managed Identity in Automation account would be enabled with VM Contributor role at the subscription level would be assigned automatically.
:::image type="content" source="media/action-groups/action-group-runbook-add.png" lightbox="media/action-groups/action-group-runbook-add.png" alt-text="Screenshot of adding a runbook action to an action group.":::
:::image type="content" source="media/action-groups/action-group-runbook-configure.png" lightbox="media/action-groups/action-group-runbook-configure.png" alt-text="Screenshot of configuring the runbook action.":::
1. Delete old runbook action which links to a *Run as account* runbook.
1. Save the action group.
## Next steps
* Get an [overview of alerts](./alerts-overview.md) and learn how to receive alerts.
* Learn more about the [ITSM Connector](./itsmc-overview.md).
* Learn about the [activity log alert webhook schema](./activity-log-alerts-webhook.md).