--- sourceDocument: Australia IT Operations Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-operations-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Operations Management ft:clusterId : - itom bundleId : - itom workflow : - Technology --- # Integrate Azure Monitor as an authenticated data source # Integrate Azure Monitor as an authenticated data source {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Integrate Azure Monitor as an authenticated data source This integration enables ServiceNow customers to connect Microsoft Azure Monitor with ServiceNow Event Management by adding Azure Monitor as an authenticated data source. This allows automatic collection and processing of Azure Monitor alert events within the ServiceNow AI Platform, improving visibility and incident response. The integration authenticates incoming Azure alerts, extracts essential event data, and inserts these events into the ServiceNow database for effective monitoring and management. Show full answer Show less ## Authentication Methods Three authentication options are supported to secure the integration: * **OAuth authentication:** Uses Azure Monitor V1 or V2 access tokens for enterprise-grade security, ensuring safe communication between Azure and ServiceNow. * **API key authentication:** Uses a REST API key to secure communication, simplifying integration while maintaining security. * **Basic webhook authentication:** Provides a simpler authentication method without Azure Active Directory, ideal for smaller or distributed teams like SRE or DevOps. ## Prerequisites * The ServiceNow user associated with the integration must have the **evtmgmtintegration** role assigned. * The **Event Management Connectors** plugin must be installed on the ServiceNow AI Platform instance. * **Azure Cloud Discovery** must be performed to bind Azure alerts to configuration items in ServiceNow. ## Event Rules and Field Mappings The base system includes default event rules and field mappings tailored for Azure Monitor alerts: * **Event Rules:** A general Azure Monitor event rule handles all incoming Azure Monitor events. * **Event Field Mappings:** Maps Azure resource types to ServiceNow configuration item types (citype), with the ability to add custom mappings as needed. Starting from the Xanadu release, out-of-the-box event rules have an enhanced setting to apply additional matching rules, enabling more flexible event processing. ## Severity Mapping Azure Monitor alert severities are mapped to ServiceNow event severities as follows: * **Fired Alerts:** From Critical (Sev0) in Azure to Critical (1) in ServiceNow, down to Warning (4) and OK (5) for lower severities. * **Resolved Alerts:** Any resolved Azure alert is mapped to ServiceNow CLEAR (0) severity. ## Azure Monitor Issue Integration Azure Issues aggregate related Azure alert signals into a single operational problem within ServiceNow, preserving investigation context and improving incident management efficiency. ## Additional Integration Features * **Bi-directional Connector:** Enables sending alert state changes from ServiceNow back to the Azure Portal, maintaining synchronization between systems. * **Integration Options:** Customers can choose between standard webhook, REST API key, or OAuth authentication methods based on their security and operational requirements. ## Practical Benefits for ServiceNow Customers * Automates event ingestion from Azure Monitor, reducing manual alert handling. * Ensures secure, authenticated data transfer between Azure and ServiceNow. * Improves incident detection and resolution through unified alert aggregation (Azure Issues). * Supports flexible authentication modes to fit different organizational needs. * Enables synchronization of alert states between ServiceNow and Azure for consistent monitoring. Integrate Microsoft Azure with Event Management by adding the Azure Monitor as an authenticated data source. You can configure the Event Management environment for the collection of events from Azure Monitor by setting your ServiceNow AI Platform instance as the rest endpoint. Once the endpoint is configured, when an Azure Monitor alert message arrives, Event Management: * Authenticates the Azure Monitor alert message with the relevant ServiceNow user, using OAuth configuration or a standard webhook. * Extracts information from the original Azure Monitor alert message to populate required event fields and inserts the event into the ServiceNow AI Platform database. * Captures specified content in the Additional Information field of the event form. {#azure-integration__ul_kf3_cpq_rv} ## What authentication is used {#azure-integration__section_xfd_qlq_cnb} There are two methods of authentication: * OAuth authentication: Provides enterprise-grade authentication to keep your enterprise environment safe. Authentication is performed using Azure Monitor V1 or V2 access tokens. For more information, see [Integrate Azure Monitor with OAuth authentication](https://www.servicenow.com/docs/AvNgIOr1I_98Mm1rIPBp_A "Integrate Microsoft Azure with Event Management by authenticating Azure V1 or V2 tokens in the Azure Monitor."). * API key authentication: Integrate using API key to secure communication between Azure and ServiceNow. For more information, see [Integrate Azure with REST API key token](https://www.servicenow.com/docs/Ro5ikIVp445Z5xwy8kKRMw "Integrate using an API key to establish secure communication and automate data exchange via REST API. This simplifies integration, enabling seamless access to services and enhancing operational efficiency."). * Basic webhook authentication: Provides a basic standard of authentication, without the need for Azure Active Directory. This authentication can be especially useful for distributed small teams, such as SRE or DevOps teams. For more information, see [Integrate Azure Monitor with basic authentication](https://www.servicenow.com/docs/a~C4vdTYwh~Fnowk2g8TRg "Integrate Microsoft Azure with Event Management by adding a standard webhook in Azure Monitor."). {#azure-integration__ul_awf_wdr_cnb} ## What to know before you begin {#azure-integration__section_xcc_xmq_cnb} You can use your integrated Azure Monitor as a data source only after you have verified the following: * For both methods of authentication, the relevant ServiceNow sys_user is assigned the evt_mgmt_integration role. * The Event Management Connectors plugin is installed in the ServiceNow AI Platform instance. You can download the plugin from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website. * Azure Cloud Discovery must be performed to ensure that the created alerts are bound to the configuration items in the ServiceNow AI Platform. For more information, see [Discovery for Microsoft Azure](https://www.servicenow.com/docs/q23bkuYZ4iaCMY21Kk3kNQ "If your cloud resources are in an Azure cloud, create a user identity called a service principal. This grants permissions to the MID Server to access selected resources."). {#azure-integration__ul_rbk_z3b_cnb} ## Event Rules and Event Field mappings {#azure-integration__section_vck_nds_qpb} These event rules and event field mappings are provided with the base system: {#azure-integration__table_mxk_pds_qpb__entry__2} | Module | Description | |-|-| | Event Rules | Azure Monitor: A general event rule to handle all Azure Monitor events. | | Event Field Mappings | Azure Monitor - ci_type: To map ci_type of events based on resourceType field. A base set of mapping pairs are provided. | [ ] {#azure-integration__table_mxk_pds_qpb} These are the mappings provided with the base system in Azure Monitor - ci_type:Figure 1. Transform Value Pairs Note: You can add new mapping pairs to the Event Field Mapping - Azure Monitor - ci_type as per the requirement, to map events to the respective ci_type based on resourceType. Starting from the Xanadu release, the OOTB (Out-Of-The-Box) rules provided with the connector, which you have not previously used (i.e., neither activated, deactivated, nor modified), will now have the Apply additional matching rules check box set to true. Previously, this check box was disabled. This change allows you to execute more event rules or automation using the same filter conditions for the connector. Note: This feature applies only to active event rules. To send alert state changes from the ServiceNow instance to the Azure Portal, enable the Azure Monitor Bi-directional connector. For more information, see [Configure Azure Monitor Bi-directional connector](https://www.servicenow.com/docs/QCykHDrohRv3h2VckrVwzQ "The Azure Monitor Pull connector sends information from ServiceNow Event Management to the Azure Portal. The pull connector sends the alert state changes from the ServiceNow environment to the Azure Portal."). ## Severity mapping from Azure severity to ServiceNow event severity {#azure-integration__section_fj3_p2n_vfc} {#azure-integration__table_pqc_s2n_vfc__entry__2} | Azure severity condition | ServiceNow event severity | |-|-| | When an Azure alert monitorCondition is Fired || | Azure Sev0 | ServiceNow Critical (severity "1") | | Azure Sev1 | ServiceNow Major (severity "2") | | Azure Sev2 and Sev3 | ServiceNow Warning (severity "4") | | Azure Sev4 | ServiceNow OK (severity "5") | | When an Azure alert monitorCondition is resolved || | Any Azure severity | ServiceNow CLEAR (severity "0") | [ ] {#azure-integration__table_pqc_s2n_vfc} * **[Azure Monitor Issue integration](https://www.servicenow.com/docs/2cO~606JtSWOPqo8724c8A)** An Azure Issue is a unified case that aggregates related alerts and signals from Azure Monitor into a single, trackable operational problem. It preserves investigation context and serves as a durable record for incident management Incident Management, so you can resolve problems faster instead of tracking scattered alerts. * **[Integrate Azure Monitor with basic authentication](https://www.servicenow.com/docs/a~C4vdTYwh~Fnowk2g8TRg)** Integrate Microsoft Azure with Event Management by adding a standard webhook in Azure Monitor. * **[Integrate Azure with REST API key token](https://www.servicenow.com/docs/Ro5ikIVp445Z5xwy8kKRMw)** Integrate using an API key to establish secure communication and automate data exchange via REST API. This simplifies integration, enabling seamless access to services and enhancing operational efficiency. * **[Integrate Azure Monitor with OAuth authentication](https://www.servicenow.com/docs/AvNgIOr1I_98Mm1rIPBp_A)** Integrate Microsoft Azure with Event Management by authenticating Azure V1 or V2 tokens in the Azure Monitor. * **[Configure Azure Monitor Bi-directional connector](https://www.servicenow.com/docs/QCykHDrohRv3h2VckrVwzQ)** The Azure Monitor Pull connector sends information from ServiceNow Event Management to the Azure Portal. The pull connector sends the alert state changes from the ServiceNow environment to the Azure Portal.