Resource impact from Azure security incidents

  • Article
  • 04/12/2025

In support of the experience of viewing impacted resources, Service Health added a feature to:

  • Display resources impacted by a security incident
  • Enable role-based access control (RBAC) for viewing security incident impacted resource information

This article explains what is communicated to users, and where they can view information about their impacted resources.

Note

This feature will be rolled out in phases. The rollout will gradually expand to 100 percent of subscription and tenant customers.

Role Based Access (RBAC) For Security Incident Resource Impact

Azure role-based access control (Azure RBAC) helps you manage who has access to Azure resources, what they can do with those resources, and what areas they have access to.
Given the sensitive nature of security incidents, role-based access is used to limit the audience of their impacted resource information. Along with resource information, Service Health provides the information shown here to users whose resources are impacted from a security incident:

Users authorized with the following roles can view security impacted resource information:

Subscription level

  • Subscription Owner
  • Subscription Admin
  • Custom Roles with Microsoft.ResourceHealth/events/fetchEventDetails/action permissions
    or Microsoft.ResourceHealth/events/action permissions

Tenant level

  • Security Admin
  • Global Admin/Tenant Admin
  • Custom Roles with Microsoft.ResourceHealth/events/fetchEventDetails/action permissions
    or Microsoft.ResourceHealth/events/action permissions" to "Custom Roles with Microsoft.ResourceHealth/events/fetchEventDetails/action permissions
    and Microsoft.ResourceHealth/events/action permissions" under both Subscription Level and Tenant Level

Viewing Impacted Resources for Security Incidents on the Service Health Portal

In the Azure portal, the Impacted Resources tab under Service Health > Security Advisories displays resources impacted from a security incident. Along with resource information, Service Health provides the information shown here to users whose resources are impacted by a security incident:

Column Description
Subscription ID Unique ID for the subscription that contains the impacted resource
Subscription Name Name for the subscription that contains the impacted resource
Tenant Name Name for the tenant that contains the impacted resource
Tenant ID Unique ID for the tenant that contains the impacted resource

The following examples show a security incident with impacted resources from the subscription and tenant scope.

Subscription

Screenshot of information about impacted resources from subscription scope in Azure Service Health.

Tenant

Screenshot of information about impacted resources from tenant scope in Azure Service Health.

Accessing Impacted Resources programmatically via an API

You can retrieve information about impacted resources for security incidents using the Events API program. Authorized users with the specified roles can access the list of resources impacted by a security incident using the endpoints provided here. For details on how to access this data, see the API documentation.

Subscription

https://management.chinacloudapi.cn/subscriptions/(“Subscription ID”)/providers/microsoft.resourcehealth/events/("Tracking ID")/listSecurityAdvisoryImpactedResources?api-version=2022-10-01

Tenant

https://management.chinacloudapi.cn/providers/microsoft.resourcehealth/events/("Tracking ID")/listSecurityAdvisoryImpactedResources?api-version=2022-10-01

Next steps