Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Azure Service Health notifications include different data properties depending on the event type (such as Service Issue, Planned Maintenance, Security Advisory, or Health Advisory) and its incident type (the specific scenario within that event). There are two ways to check the metadata of Service Health:
- The Activity Log
- Azure Resource Graph
Each type of notification serves a specific purpose and comes with its own metadata. This metadata helps you understand what's happening to your resources and what level of attention the issue requires.
Event types describe the broad category of the issue that Azure is reporting.
Incident types provide specific context, such as whether the issue is a platform‑initiated outage, a scheduled maintenance update, or an advisory that might require action.
When you understand what each type of notification means, you can more easily decide what needs immediate action. You can also set up the right alerts and create dashboards or workflows that show the true effect on your environment.
In other words, the event type tells you why Azure is contacting you. The incident details tell you what to do next to help you stay informed, maintain continuity, and act quickly and confidently when your services are affected.
Azure Resource Graph
In the ServiceHealthResources table, Service Health event properties are metadata fields that explain what happened, how severe the issue is, and the event’s current status.
For information about event tags, see Service Health event tags to see how they're used in Service Health.
Key properties include
- Type of Incident from
properties.EventType(for example, ServiceIssue, or PlannedMaintenance) - properties.Status as (Active or Resolved)
- Timestamps such as properties.impactStartTime and properties.impactMitigationTime
Start by checking properties.incidentType to understand what kind of issue and detail is involved, then review Level for severity.
To learn how to use Resource Graph queries, see Resource Graph overview.
Azure Activity logs
The following table lists and describes some representative properties found in a Service health event in the Activity log.
Key properties include
- Type of Incident from
properties.incidentType(for example, Incident, or Maintenance) - Status as (Active or Resolved)
- Timestamps such as properties.impactStartTime and properties.impactMitigationTime
Start by checking properties.incidentType to understand what kind of issue and detail is involved, then check the level for the severity. To learn how to use Azure Activity logs, see Azure Activity log event schema.
| Property name | Description |
|---|---|
| correlationId | Usually a GUID in the string format. Events that belong to the same action usually share the same correlationId. |
| eventDataId | The unique identifier of an event. |
| eventName | The title of the event. |
| level | The level of the event. |
| eventTimestamp | Timestamp when the event was generated, and the Azure service processing the request corresponding to the event. |
| submissionTimestamp | Timestamp when the event became available for querying. |
| subscriptionId | The Azure subscription in which this event was logged. |
| status | String describing the status of the operation. Values are: Active and Resolved. |
| operationName | The name of the operation. |
| category | This property is always ServiceHealth. |
| resourceId | The Resource ID of the impacted resource. |
| Properties.title | The localized title for this communication. English is the default. |
| Properties.communication | The localized details of the communication with HTML markup. English is the default. |
| Properties.incidentType | One of the following values: ActionRequired, Informational, Incident, Maintenance, or Security. |
| Properties.trackingId | The incident this event is associated with. Use this tracking ID to correlate the events related to an incident. |
| Properties.impactedServices | An escaped JSON blob that describes the services and regions impacted by the incident. The property includes a list of services, each of which has a ServiceName, and a list of impacted regions, each of which has a RegionName. |
| Properties.defaultLanguageTitle | The communication in English. |
| Properties.defaultLanguageContent | The communication in English as either HTML markup or plain text. |
| Properties.stage | The possible values for Incident, and Security are Active, Resolved, or RCA. For ActionRequired or Informational the only value is Active. For Maintenance they are: Active, Planned, InProgress, Canceled, Rescheduled, Resolved, or Complete. |
| Properties.communicationId | The communication this event is associated with. |
Note
Billing notifications aren't shown in the Activity log located in the Azure portal. You only see them in Azure Service Health.