Today we shall see how to trigger runbooks using webhooks when an alert is fired from Azure Monitor.

To illustrate this, I have taken a specific example of triggering a runbook, when an Azure virtual machine is de-allocated.

Step 1: Simulate a de-allocation event by Stopping a virtual machine.

Step 2: Check the activity logs for the de-allocation event.

 

Step 3: Click on the “+ Add activity log alert”. This will start up a pane to fill out the alert details.

 

Step 4: Before filling out the alert details, I encourage you to go ahead and create an empty Runbook. So that you can create the webhook for the Runbook, which is required while filling out the alert details.

 

Step 5: Once you click on the “Webhook”, you will get the below pane. Click on “Create new webhook” and fill out the details accordingly. Make sure you copy the URL, this information is not available again once the webhook is created.

 

Additionally, you can specify how the webhook is to be run. It will be either “Azure RunAs account” or “Hybrid Worker”

 

Step 6: Now go back to the alert, and fill the details:

“Event Initiated By” field can contain blank space to monitor all de-allcoation events. or specify Id upon which an alert is triggered only when that user initiates de-allocation event.

Under Actions, select the “Webhook” action type and specify the webhook URL that we created in the previous step.

This ensures, that when ever a de-allocation event occurs, this alert will be fired. And this alert will in turn trigger the runbook via its webhook.