Azure Monitor Metrics and Alerts

Azure Monitor is the unified observability platform for all Azure resources. It collects metrics (numerical time-series data) and logs (structured records of events) from every service you deploy. Without Azure Monitor you would be operating blind — unable to detect performance degradation or capacity issues before they affect users.

Platform metrics are automatically collected for every Azure resource at no extra cost. For a virtual machine, Azure Monitor captures Percentage CPU, Network In, Network Out, Disk Read Bytes, and many more. These metrics are stored at one-minute granularity for 93 days in the metrics store. No agent or configuration is required to start seeing them.

The Metrics Explorer in the Azure portal lets you chart any platform metric interactively. Select a resource, choose a metric namespace, pick a metric, and choose an aggregation type (Average, Maximum, Minimum, Count, or Sum). You can overlay multiple metrics, split by dimension (e.g. by disk or network interface), and pin the chart to an Azure Dashboard.

A metric alert rule triggers when a metric crosses a fixed threshold for a defined evaluation period. For example: fire an alert when Percentage CPU is greater than 85% for 5 consecutive minutes. Alert rules consist of a target resource, a condition, and an action group that defines what happens when the alert fires.

Dynamic thresholds use machine learning to automatically set alert boundaries based on historical behaviour. Instead of hardcoding a CPU percentage, Azure Monitor learns the normal pattern of your metric and alerts only when the value deviates significantly. This reduces false positives for metrics whose natural level varies by time of day or day of week. Set sensitivity to Low, Medium, or High.

An action group defines the notifications and automated actions that run when an alert fires. Supported notification types include Email/SMS/Push, Voice, and Azure app notifications. Automated actions include calling an Azure Function, posting to a Logic App, triggering a webhook, or running an Automation Runbook. One action group can be shared across many alert rules.

Every alert rule is assigned a severity from Sev 0 (Critical) to Sev 4 (Verbose). Severity does not affect when the alert fires — it is metadata used by operations teams to triage incidents. Best practice is to page on-call engineers only for Sev 0 and Sev 1 alerts, route Sev 2 to a ticket queue, and treat Sev 3–4 as informational.

Activity log alerts fire on administrative operations recorded in the Azure Activity Log rather than on metrics. Use them to get notified when someone deletes a resource group, changes a network security group rule, or restarts a VM. They are configured identically to metric alerts but target an activity log condition such as operation name or resource type.

An alert instance moves through three states: Fired → Acknowledged → Resolved. Alert processing rules (formerly suppression rules) let you suppress notifications during scheduled maintenance windows or add action groups to all alerts that match a scope — without modifying each alert rule individually. This is essential for managing alert noise during deployments.

Platform metrics are not limited to VMs. App Service exposes Http5xx, RequestCount, and AverageResponseTime. Azure SQL Database exposes cpu_percent and dtu_consumption_percent. Azure Storage exposes UsedCapacity and Transactions. You apply the same metric alert model across all these services, giving you a uniform monitoring approach regardless of resource type.

Azure Monitor supports multi-resource metric alerts that apply a single rule to all resources of the same type in a subscription or resource group. For example, one alert rule can monitor all VMs in a resource group for high CPU. This dramatically reduces the number of rules you need to manage compared to creating one rule per VM. Multi-resource alerts are scoped to a resource group or subscription and a specific resource type.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Azure Monitor automatically collects platform metrics from every Azure resource, metric alert rules trigger on static or dynamic thresholds and notify teams via action groups, and activity log alerts fire on administrative operations like resource deletion. Next up we explore Log Analytics and KQL for querying structured log data.