Create a Webhook from Azure Alerts to a Logic App

March 26, 2020 3 Comments

This is part 2 in the scenario Perform Automation Based on Device Enrollment in Microsoft Intune.

This post describes how to take the Azure Alert configured in Using Log Analytics to Generate Alerts for Each New Intune Device Enrollment, and send it to a webhook-enabled Logic App.

Remind me, Greg, why would I want to do such a thing?

This all goes back to the scenario, and our goal to create/update an asset record in ServiceNow based on a new device enrollment in Intune. For this post, we have an alert from part 1, so now we need to take that alert and generate a webhook to a Logic App.

Figure 1 – Creating a webhook from Azure Alerts to a Logic App

And that’s the high-level description. Now let’s get into the details for HOW to make this happen.

Prerequisites

To perform the steps in this post, complete all the steps and prerequisites in part 1, Using Log Analytics to Generate Alerts for Each New Intune Device Enrollment.

Create a Logic App with Webhook

First, we create the Logic App so that we can configure the Azure alert to call the webhook.

  1. In the Azure portal, navigate to Logic Apps and click Add.
  2. Select the desired Resource group (use the same one as in part 1!), Location, and enter a Logic App name of DeviceEnrollment as shown in Figure 2.
  3. Select Review + Create and then Create.
Figure 2 – Create a new Logic App
  1. Within a few seconds, you’ll receive the message that Your deployment is complete, then select Go to resource.
  2. The Logic Apps Designer page will appear with an option to Start with a common trigger. Choose the option When a HTTP request is received, as shown in Figure 3.
Figure 3 – Create a Logic App using the HTTP trigger
  1. The Logic Apps Designer will appear as shown in Figure 4. Leave it just as it is and click Save. You’ll notice that the text in the gray box will change to a real URL once you save the Logic App. (For this process, there’s no need to copy the URL, because this integrates nicely with Azure Monitor).
Figure 4 – Logic App with Webhook

Congrats! You created a Logic App! Granted, it’s pretty basic, but we’ll be building on it very soon.

Configure Azure Alert with HTTP Trigger

Now we’re going to configure the Azure Alert to call this webhook for the alert created in part 1.

  1. In the Azure portal, navigate to Alerts.
  2. Click Manage Alert Rules as shown in Figure 5
Figure 5 – Manage alert rules
  1. Locate the rule created in part 1 (we called it New Device Enrolled).
  2. In the ACTION GROUPS section, click Create as shown in Figure 6.
Figure 6 – Create a new action
  1. In the Add action group pane, enter an Action group name, Short name, Resource group (the same one used earlier) and enter DeviceEnroll for the action name, as shown in Figure 7.
Figure 7 – Add action group
  1. Next, select the drop-down for Action type and choose LogicApp.
  2. In the small frame, select the Resource group (the same one used earlier).
  3. In the Select a logic app option, choose the Logic App created earlier (we called it DeviceEnrollment).
  4. Select Yes for Enable the common alert schema. Click the link to Learn more about the common alert schema – we’ll need that information for the Logic App webhook integration.
  5. Verify settings as shown in Figure 8 and select OK.
  6. Click OK to save settings on the Add action group pane.
Figure 8 – Configure the Action Type

Congratulations! You now have an alert that will make a call to a Logic App! You have now configured everything in the blue box shown in Figure 9.

Figure 9 – Progress in the scenario to update ServiceNow based on Intune Device Enrollment

Continue the scenario here: Processing an Azure Alert with a Logic App.

Greg

Filed under Automation, Intune Tagged with ,

Using Log Analytics to Generate Alerts for Each New Intune Device Enrollment

March 20, 2020 3 Comments

This is part 1 in the scenario Perform Automation Based on Device Enrollment in Microsoft Intune.

This post describes how to trigger an Azure Monitor alert based on a Device Enrollment event in Microsoft Intune.

Why would I want to do such a thing?

Oh, let me count the reasons! Event-triggered actions are very powerful. Typically when you think of an ‘alert’, it’s probably because something bad happened (think of a monitoring alert for low disk space, for example). For this post, we’re going to create an alert based on the desired event, device enrollment. There are many scenarios where an IT admin wants to know when a device is actually enrolled in order to follow up with the user, mark a request as complete, or just ensure that devices are being properly managed.

Here’s an image of what we will accomplish in this post:

Figure 1 – From Device Enrollment to Azure Alert

So to break down these steps:

  1. User enrolls device
  2. Device registers with Azure AD and Intune
  3. Intune sends “OperationalLogs” message to Log Analytics
  4. Log Analytics query criteria are met and send an event to Azure Alerts

And that’s the logical process in a nutshell! Now, let’s get into the details for HOW to make that happen.

Prerequisites

To perform the configuration steps, you must have a Microsoft Intune Environment and a Log Analytics workspace in Azure. And to test, you’ll need a device to enroll.

Configure Intune Diagnostic Settings

  1. In the Azure portal, navigate to Microsoft Intune.
  2. In the Monitoring section, select Diagnostic Settings and then select Add diagnostic setting (Figure 2).
  3. In the Diagnostic Settings dialog, enter a descriptive Diagnostic settings name, and select OperationalLogs (Figure 3).
  4. Under Destination details, select Send to Log Analytics. Choose your desired subscription and workspace (Figure 3).
  5. Click to Save the Diagnostics settings.
Figure 2 – Add diagnostic settings
Figure 3 – Configure diagnostic settings

Operational logs (OperationalLogs) show the success or failure of users and devices that enroll in Intune, as well as details on non-compliant devices. For our scenario, we will filter the Operational Logs for device enrollment.

Test Diagnostics Sent to Log Analytics!

To test:

  1. Enroll a fresh device to Intune.
  2. Verify the device is visible in the All Devices node in Intune.
  3. Once the node is visible, launch Log Analytics and open the workspace selected in Figure 3.
  4. Search Tables for IntuneOperationalLogs (Figure 4) and then double-click it so that it appears in the query frame.
  5. Select IntuneOperationalLogs and then click Run.
Figure 4 – Run Log Analytics query to show results from IntuneOperationalLogs

Sometimes it may take up to ten minutes from the time you see the device in Intune until the time you will see it in Log Analytics, but in general, this happens fairly fast.

Expand the result, and expand the Properties section to view device-specific details, as shown in Figure 5.

Figure 5 – Log Analytics search results for IntuneOperationalLogs

As you can see in Figure 5, we can see this is an enrollment message. Scroll down the page to see the additional properties, as shown in Figure 6.

Figure 6 – Additional properties for the query IntuneOperationalLogs

Create an Azure Alert

Now that we have the data in Log Analytics, we can easily generate an alert. We’re going to create an alert rule so that any time a new record appears that meets our criteria, an alert will be triggered.

First, update the Log Analytics query criteria in Figure 4.0 to the following: 

IntuneOperationalLogs | where OperationName == 'ESPEnrollment' and Category == 'OperationalLogs'

This query will help us filter so that we only generate alerts for device enrollment. Go ahead and Run the query to verify the results.

Figure 7 – Run sample query with filtered criteria

Highlight the query and select New alert rule as shown in Figure 7.

Figure 8 – Creating a monitoring alert rule in Azure

From Figure 8, you can see the connected Log Analytics instance, as well as other configuration information. Notice that the Condition requires additional information. Click on the highlighted text that reads ‘Whenever the custom log search is greater than…..’ and review the following settings, as shown in Figure 9.

  1. Add the following Search query:
IntuneOperationalLogs | where OperationName == 'ESPEnrollment' and Category == 'OperationalLogs'
  1. Under Alert logic, configure as shown in Figure 9.
  2. Under Evaluated based on, configure as shown in Figure 9. This sets the rule to evaluate every five minutes, based on the last five minutes.
  3. Verify settings and click Done.
Figure 9 – Configuring the Condition for the Alert Rule

To complete the Alert Rule, add an Alert rule name called New Device Enrolled and set the Severity to Sev 4, as shown in Figure 10. Then click Create alert rule.

Figure 10 – Creating the Alert Rule

Congratulations! You have successfully created an alert rule based on a filter in Log Analytics! Please proceed to Create a Webhook from Azure Alerts to a Logic App.

Review the Scenario: Perform Automation Based on Device Enrollment in Microsoft Intune

Greg

Filed under Automation, Intune, Log Analytics, Microsoft Endpoint Manager, Misc Tagged with ,

← Older posts

Newer posts →