Azure search action group

You can use microsoft.insights/metricalerts and microsoft.insights/activitylogalerts to find out which Action Groups are in which Alerts.

Thank you Billy York and Juval. Posting your suggestion as an answer to help community members.

Resources
| project
    alertName = name,
    location,
    type,
    props = properties
| where type contains "microsoft.insights/activitylogalerts" 
| mvexpand actionGroups = parse_json(props["actions"]["actionGroups"])
| extend actionGroup = extract(@"([^\/]+$)",1,tostring(actionGroups.actionGroupId))
| union 
    (
        resources
        | project
            alertName = name,
            location,
            type,
            props = properties
        | where type contains "microsoft.insights/metricalerts" 
        | mvexpand actionGroups = parse_json(props["actions"])
        | extend actionGroup = extract(@"([^\/]+$)",1,tostring(actionGroups.actionGroupId))
    )

az monitor activity-log alert action-group add -n {AlertName} -g {ResourceGroup} \
  --action /subscriptions/{SubID}/resourceGroups/{ResourceGroup}/providers/microsoft.insights/actionGroups/{ActionGroup} \
  --webhook-properties usage=test owner=jane

You can refer to Is there a smart way to find out which Action Groups are in which Alerts?, az monitor activity-log alert action-group and How to create an alert rule using PowerShell and Azure CLI

Query

The following is a Kusto query that provides alert rules that use a given action group.

Resources
| project
    alertName = name,
    enabled = case(properties.enabled == true, true, properties.state == "Enabled", true, false),
    location,
    type,
    props = properties
| where type in (
    "microsoft.insights/metricalerts",
    "microsoft.insights/activitylogalerts",
    "microsoft.alertsmanagement/smartdetectoralertrules",
    "microsoft.insights/scheduledqueryrules")
| where enabled == 1
| mvexpand actionGroup = extract_all(@'(?i:/microsoft.insights/actionGroups/(?P<actionGroup>.*?)")', tostring(props))
| project alertName, enabled, location, type, actionGroup, props
| where actionGroup =~ "Developers"
| order by ["alertName"] asc

To Use

Alter the name of the action group in the second to last line, or comment out the line completely to see all rule-to-action-group pairings.

Caveats

• There may be other alert rule types than the 4 (common) types in this query.
• We are using an mv-expand operation to expand rules that contain multiple action groups into multiple rows.