{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":30269,"path":"it-operations-management/event-management/azure-events-webhook.md","title":"Integrate Azure Monitor with basic authentication","bundle":null,"doc_type":null,"release":"australia","body":"\n# Integrate Azure Monitor with basic authentication\n\nIntegrate Microsoft Azure with Event Management by adding a standard webhook in Azure Monitor.\n\n## Before you begin\n\nEnsure that the Event Management Connectors \\(sn\\_em\\_connector\\) plugin is installed on the ServiceNow AI Platform instance.\n\nEnsure you have created a user with an **Identify Type** of **Machine** and the evt\\_mgmt\\_integration role.\n\nRoles required: evt\\_mgmt\\_admin and web\\_service\\_admin\n\n## About this task\n\nConfigure the Event Management environment for the collection of events from Azure by authenticating Azure Monitor as a data source. In your Azure Monitor portal, set your ServiceNow AI Platform instance as the rest endpoint using a standard webhook.\n\nOn the Azure portal, alert correlation rules are defined through the **Correlate alerts** setting within Alert Processing Rules. When **Correlate alerts** is assigned on the Azure portal, the Azure Monitor alerts received on the ServiceNow® instance within 60 minutes are grouped using tag based alert clustering.\n\n## Procedure\n\n1.  In the ServiceNow AI Platform, create a user account or identify an existing ServiceNow user for this integration.\n\n    Also ensure the relevant ServiceNow sys\\_user is assigned the evt\\_mgmt\\_integration role. To ensure proper authentication, use the least privileged user with the evt\\_mgmt\\_integration role, rather than a high privileged user.\n\n2.  In your Azure Monitor portal, update the Azure Monitor alert rules to use an action group with a standard webhook:\n\n    1.  Create an action group with **action type=webhook**, and provide the URL that includes the user ID and password of the ServiceNow user in the endpoint.\n\n        For example:\n\n        `https://<username>:<password>@<instance-name>.service-now.com/api/sn_em_connector/em/inbound_event?source=azuremonitor`\n\n        **Note:** If you have multiple tenants on the Azure portal and you want to use bidirectional functionality to acknowledge, close, or reopen an alert on the Azure Portal, then the URL for the webhook has to be in the following format: `https://<username>:<password>@<instance-name>.service-now.com/api/sn_em_connector/em/inbound_event?source=azuremonitor&event_class=<new_connector_instance_name>`. The &lt;new\\_connector\\_instance\\_name&gt; is the new Azure pull connector instance that you need to create for each tenant with other Azure service principal credentials. To know how to create the pull connector, see [Configure Azure Monitor Bi-directional connector](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/configure-azure-bi-directional-connector.md).\n\n    2.  In the Webhook section, make sure that **Yes** is selected for the **Enable the common alert schema** option.\n\n\n## Result\n\nAlerts start flowing from the Azure Monitor into the Event Management plugin. The plugin extracts information from the original Azure Monitor alert message to populate the required event fields and inserts the event into the database. In your ServiceNow AI Platform instance, navigate to **All Events** to see the events.\n\n## What to do next\n\nIf you want to send alert state changes on the ServiceNow instance from the ServiceNow alerts to the Azure Portal, you need to enable the Azure Monitor Bi-directional connector. For more information, see [Configure Azure Monitor Bi-directional connector](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/configure-azure-bi-directional-connector.md).\n\n**Parent Topic:**[Integrate Azure Monitor as an authenticated data source](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-operations-management/event-management/azure-integration.md)\n\n"}}