In your subscription certain identities (User1, Principal1, and Group1) are assigned the Monitoring Reader role. An action group AG1 is configured to email the Monitoring Reader role and is used by an alert rule. Who will receive an email from AG1 when the alert fires?

When an action group is configured to email a role, Azure sends emails to all users who are directly assigned that role. In this scenario, User1 is directly assigned the Monitoring Reader role. User2 is also directly assigned this role. Principal1 is a service principal, not a user, and will not receive emails from an action group configured for a role. Group1 is an Azure AD group, and members of a group assigned a role do not receive emails; only direct role assignments to users are considered for action group emails to roles. Therefore, only User1 and User2 will receive the email.