service-health

Azure service health of a subscription

Returns how many Azure service issues touching a subscription are active, how many planned maintenances and advisories, and the titles of the issues, read from Azure Resource Health with a service principal that may only read. An outage of Azure itself in a region the subscription uses shows here before the tickets come in. Three watches are offered, each one set on the probe.

Versions

Generic: Azure Resource Health is one service, the same for every subscription. The collector asks for the API version 2025-05-01 of Microsoft.ResourceHealth.

How it works

1. POST https://login.microsoftonline.com/<azure:tenant>/oauth2/v2.0/token, the form grant_type=client_credentials&client_id=…&client_secret=…&scope=https://management.azure.com/.default: an access token, kept thirty minutes in the probe's cache, encrypted on the poller. A token Azure no longer takes answers 401, and the collector logs in again, once.
2. GET https://management.azure.com/subscriptions/<azure:subscription>/providers/Microsoft.ResourceHealth/events?api-version=2025-05-01&queryStartTime=<the date 30 days ago>, the token as Authorization: Bearer, page after page by nextLink.

{"value": [{"name": "BC_1-FXZ", "properties": {"eventType": "ServiceIssue", "status": "Active", "title": "ACTIVE: Virtual machines in West US", "impact": [{"impactedService": "Virtual Machines", "impactedRegions": [{"impactedRegion": "West US", "status": "Active"}]}]}}], "nextLink": "…"}

• Only the events whose status is Active count. issues counts those of type ServiceIssue, maintenances those of type PlannedMaintenance, advisories those of type HealthAdvisory and SecurityAdvisory; the other types (RCA, EmergingIssues, Billing) are not counted.
• issue-titles joins the titles of the active issues by | , empty when there is none.
• queryStartTime: without it, Azure lists only the events updated in the last three days, and an issue still active but not updated since would drop out of the list. The collector asks for those updated in the last thirty days, the date written month/day/year in UTC from the poller's clock.
• A next page is only followed on https://management.azure.com/, where the token may go; any other address stops the collector unreachable.
• A code 400 or 401 on the login stops the collector misconfigured (the tenant, the client or its secret refused); a code 403 on the list (the role missing), 400 or 404 (the subscription unknown) too; any other code but 200 stops it unreachable.

The client secret comes from protocol:http:password, a secret variable: it goes in the body of the login only, to https:// only. The token is a secret too, kept in the cache and sent in a header. The events are not secret.

Prerequisites

• A service principal: an app registration in Microsoft Entra ID with a client secret. Its application (client) ID goes in protocol:http:user, its secret in protocol:http:password, its tenant in the variable azure:tenant.
• The role Reader given to it on the subscription: */read and nothing else. With Azure CLI: az role assignment create --assignee <client id> --role Reader --scope /subscriptions/<subscription id>.
• The poller reaches login.microsoftonline.com and management.azure.com in HTTPS. Their certificates are issued by public authorities: the profile "Standard" trusts them.

Variables

Outputs

Watches

Limits

• The events are those Azure says touch the subscription, in every region and service; the collector does not narrow them to the services the subscription uses in a region.
• An event marked sensitive (isEventSensitive, a security advisory) keeps its summary and its updates behind another route, fetchEventDetails, which the collector does not call: it is counted, not read.
• Not checked against an Azure subscription: the route, parameters and fields are those of the Azure REST API reference (learn.microsoft.com: "Events - List By Subscription Id" in 2025-05-01, the enumerations EventTypeValues and EventStatusValues) and of the Microsoft identity platform ("OAuth 2.0 client credentials flow").