How to create alert on the azure iot device on disconnect status

The following screen snippet is an example of using the Device Connectivity Events in the Data Export feature (mentioned by @humblejay’s answer) for your device connectivity watchdog:

As the above picture shows, the concept is very simple, when the device is disconnected, the watchdog message (such as the CloudEvents message) with the TimeToLive (5 minutes) is sent to the watchdog queue. In the case, when the device is reconnected within the watchdog time, the message is deleted from the watchdog queue, otherwise the message is forwarded to the Alert queue when its TTL is expired.

Note, that the device connectivity events is generated with some limitations, see more details here.

1. Data Export:

1a. Destination – Webhook:

1b. Data Transform:

if .messageSource == "deviceConnectivity" then
{
  specversion:"1.0",
  id:.applicationId,
  source: .device.id,
  subject: ("/" + .applicationId + "/" + .device.id + "/" + .messageSource),
  type:.messageType,
  time:.enqueuedTime,
  dataschema:"#",
   data:{  
    reportedProperties: .device.properties.reported,
    cloudProperties: .device.cloudProperties
  }
}
else
  empty
end

2. HttpTrigger Azure Function (version 3.x):

    #r "Newtonsoft.Json"
    #r "..\bin\Microsoft.Azure.ServiceBus.dll"

    using System.Text;
    using System.Net;
    using Microsoft.Azure.ServiceBus;
    using Microsoft.Azure.ServiceBus.Core;
    using Microsoft.AspNetCore.Mvc;
    using Microsoft.Extensions.Primitives;
    using Newtonsoft.Json;
    using Newtonsoft.Json.Linq;

    public static async Task<IActionResult> Run(CloudEvent ce, IDictionary<string, string> headers, ILogger log)
    {
        log.LogInformation($"Device: {ce?.source}, Type: {ce?.type}, Subject: {ce?.subject}");

        string servicebusConnectionString = System.Environment.GetEnvironmentVariable("rk2016_SERVICEBUS"); 
        string queueName = headers.ContainsKey("queueName") ? headers["queueName"] : "iotc";
        double timeToLiveInMinutes = headers.ContainsKey("timeToLiveInMinutes") ? Convert.ToInt32(headers["timeToLiveInMinutes"]) : 5;
   
        if(ce != null && ce.subject.LastIndexOf("/deviceConnectivity") > 0)
        {
            // delete a device watchdog message
            var receiver = new MessageReceiver(servicebusConnectionString, queueName, ReceiveMode.PeekLock);
            var messages = await receiver.ReceiveAsync(100, TimeSpan.FromSeconds(2)); 
            if(messages != null)
            {  
                log.LogInformation($"Number of watchdogs {messages.Count()} in the queue '{queueName}'");
                foreach(var message in messages) 
                {          
                    string deviceId = message.UserProperties.ContainsKey("deviceId") ? message.UserProperties["deviceId"].ToString() : "";    
                    if(message.Label.StartsWith("Watchdog_") && ce.source == deviceId)  
                    {
                        await receiver.CompleteAsync(message.SystemProperties.LockToken);
                        log.LogInformation($"Watchdog deleted: Device={ce.source}, ttl={ce.time - message.SystemProperties.EnqueuedTimeUtc}.");
                        // break;
                    }
                };
            } 
            else 
            {
                log.LogInformation($"No Watchdog in the queue '{queueName}'.");
            }
            await receiver.CloseAsync();

            if(ce.type == "disconnected")
            {
                // create a device watchdog message
                var sender = new MessageSender(servicebusConnectionString, queueName);
                var message = new Message(Encoding.UTF8.GetBytes(JsonConvert.SerializeObject(ce)))
                {
                    ContentType = "application/json",
                    Label = $"Watchdog_{ce.source}",
                    TimeToLive = TimeSpan.FromMinutes(timeToLiveInMinutes)
                };
                message.UserProperties.Add("deviceId", ce.source);

                await sender.SendAsync(message);
                log.LogInformation($"Watchodg created: Device={ce.source}, time={ce.time}.");
            }
        }
        else
        {
        log.LogWarning("Wrong event message");
        }
  
        return await Task.FromResult<IActionResult>(new NoContentResult());
    }

    public class CloudEvent 
    {
        public string  specversion {get; set;}
        public string  type {get; set;}
        public string  source {get; set;}
        public string  id {get; set;}
        public DateTime  time {get; set;}
        public string  subject {get; set;}
        public JObject  data {get; set;}
    }
  

Also, I do recommend to add one more destination target, such as the endpoint of the Azure Event Grid custom topic with a CloudEvents input schema, see the following screen snippet:

Moving the above HttpTrigger Azure Function to the AEG subscriber is giving for your solution a Pub/Sub flexibility for distributing the device connectivity events such as a filtering, etc.