Power-state changes to an Azure virtual machine, such as the VM being stopped or deallocated through a control-plane operation, are recorded as administrative entries in the Azure Activity Log, which tracks every subscription-level operation performed against an Azure resource through Azure Resource Manager. Because turning a virtual machine off is exactly this kind of control-plane, administrative operation rather than a metric or a log query result, an alert rule that must fire when a VM is turned off needs to use the Activity Log signal type, configured to filter on the relevant operation name, such as the deallocate or power off action recorded against that specific virtual machine resource. A Log signal type, which is based on Log Analytics and Kusto Query Language queries, is used for alerting on data that has been collected into a Log Analytics workspace, such as performance counters or custom application telemetry, rather than on subscription-level control-plane events like a VM power-state change, so it is not the appropriate signal type here. Service Health is reserved specifically for alerting on Azure platform incidents, planned maintenance, and service issues affecting the platform itself, not on customer-initiated actions such as a specific virtual machine being turned off, so Activity Log is the correct and only appropriate signal type for this alert rule.