Cascade Regional Airlines wants an immediate notification any time someone deletes a resource group in the subscription, so leadership can be alerted quickly if it happens outside a planned maintenance window. An engineer configures a metric alert on the subscription scope, but it never fires when a test resource group is deleted. What is the most likely reason, and what should be configured instead?

Resource group deletion is a control-plane operation recorded in the Azure activity log, not a numeric time series, so it can only be detected by an activity log alert, which evaluates entries in that log against criteria such as operation name, resource type, and status. A metric alert has no visibility into activity log entries at all, since it only evaluates numeric metrics like CPU or throughput, which is why it silently never fires regardless of tuning. Missing an action group would cause the alert to fire without notifying anyone, but the scenario describes the alert never firing at all, which points to the wrong alert type rather than a missing notification target. A diagnostic setting affects where resource-level logs and metrics are routed for platforms like storage or networking; the subscription-level activity log is captured automatically and does not require a diagnostic setting to exist or be queryable through an activity log alert. Adjusting the aggregation interval only tunes how a metric alert samples numeric data and has no bearing on an event-based condition. The fix is to create an activity log alert scoped to the subscription, filtered to delete operations, and to validate it by performing a test deletion in a non-production resource group and confirming the alert fires.