Azure Monitor serves as the central hub for collecting, analyzing, and acting on telemetry from applications and infrastructure running in Azure or on-premises. The service pulls together data from multiple sources—including metrics (numerical measurements like CPU usage), logs (detailed event records), and activity events (management operations like resource creation)—into one unified platform. This consolidated approach lets IT teams see the full picture of system health rather than juggling separate tools. Azure Monitor integrates with other Azure services to provide end-to-end monitoring, meaning it can watch everything from virtual machines to web apps within the same system.
A system architecture diagram showing how Azure Monitor collects metrics, logs, and activity events from Azure and on-premises sources, stores and analyzes them using Log Analytics and KQL, triggers alerts via action groups, and visualizes the data through dashboards and workbooks.
Log Analytics functions as the storage engine and query tool within Azure Monitor. It holds all the log data that Azure Monitor collects and provides the Kusto Query Language (KQL) for searching and analyzing those logs. Teams can write custom queries to dig into specific problems, build dashboards that visualize trends over time, and create workbooks that combine metrics with log data for richer analysis. The query capability is what transforms raw log data into actionable insights.
Azure Monitor alerts work as the notification system that tells you when something needs attention. You create alert rules that watch for specific conditions—such as CPU usage exceeding 90% or a particular error appearing in logs—and when those conditions met, alerts trigger action groups. An action group defines how you get notified (email, SMS, webhook) and can even run automated responses through Azure Functions or Logic Apps. This automation means your team doesn't have to watch dashboards constantly; the system alerts you the moment problems arise.
Application Insights is the application performance monitoring piece of Azure Monitor that automatically gathers telemetry from your code. It tracks HTTP requests, database calls, exceptions, and user interactions without requiring you to write logging code manually. The autoinstrumentation feature lets you enable this monitoring just by adding a connection string to your app, making it accessible even to developers who aren't monitoring experts. Application Insights then feeds this data into Azure Monitor Logs where it can be queried alongside infrastructure logs.
Log Analytics collects and stores data from many different sources into centralized repositories called workspaces. A workspace acts as a container that holds all your log data, defines how long data is retained, controls who can access it, and determines your pricing plan. You can pull logs from Azure resources like virtual machines and storage accounts, from on-premises servers using agents, and from third-party systems through Event Hubs or APIs. Understanding which sources feed into your workspace is the first step to building comprehensive monitoring, because gaps in source coverage mean gaps in your visibility.
The analysis power of Log Analytics comes from Kusto Query Language (KQL), a declarative language designed specifically for searching and visualizing log data. KQL lets you filter data to show only relevant events, aggregate numbers to see totals or averages, and render results as tables or charts. Commands like where filter rows, summarize groups and calculates, and render creates visualizations. The language is readable even for beginners while being powerful enough for complex analytics. Query results can feed directly into dashboards, workbooks, or alert rules, making KQL the bridge between raw data and actionable information.
Workspaces let you create, save, and manage queries through the Azure portal or REST APIs, enabling teams to share useful queries and collaborate on investigations. Workspace settings control data retention periods and access permissions, which helps organizations meet compliance requirements and manage costs. You can organize queries with naming conventions and tags to make them easy to find. This management capability ensures that as your monitoring needs grow, your queries remain organized and secure.
Log Analytics also powers Azure Monitor Alerts by serving as the data source for log-based alert rules. When you create a log alert, you write a KQL query that runs on a schedule, and when results match your condition, the alert fires. This integration means you can alert on any pattern detectable in your logs, from simple error counts to complex behavioral analysis. Combined with Application Insights telemetry, Log Analytics gives you a complete picture of both infrastructure and application behavior.
Azure Monitor alerts notify your team when important conditions arise in your environment, enabling proactive response before users notice problems. There are three main alert types: metric alerts watch numerical values like CPU percentage or memory usage; log alerts run KQL queries against Azure Monitor Logs to find specific events; and activity log alerts track management operations like someone creating or deleting a resource. Each type serves a different monitoring need, and most organizations use all three to get complete coverage.
Alert configuration centers on creating alert rules, which define exactly what conditions should trigger a notification. To create a rule, you specify the target resource (like a specific virtual machine or all resources in a resource group), the signal type (metric, log, or activity log), the threshold or condition that matters, and how long the condition must persist before firing. This precision helps avoid alert fatigue from conditions that spike briefly but resolve on their own. Once an alert rule is active, it continuously evaluates the defined condition against incoming data.
When an alert fires, notifications travel through action groups that define the delivery method and recipients. An action group bundles together notification channels such as email, SMS, webhooks, or automation runbooks. You might have one action group for critical issues that emails the on-call team and texts the manager, while another action group for warnings just emails a distribution list. Action groups are reusable across multiple alert rules, so you set them up once and apply them wherever needed.
Alert processing rules (formerly called action rules) give you additional control over alert behavior. They can suppress alerts during planned maintenance windows, when you know systems will be unavailable and don't want to be flooded with notifications. Processing rules can also route specific alerts to different action groups based on criteria like severity or resource tags. You create these rules through the Azure portal, CLI, or REST API, and they integrate with automation tools like Azure Logic Apps or Azure Functions for advanced response workflows. Effective alert management requires organizing resources logically, using consistent naming conventions, and regularly reviewing rules to ensure they still match your current performance baselines.
Application Insights monitors the performance and usage of web applications by automatically collecting telemetry data from your code. It tracks HTTP requests to see how fast your app responds, dependencies to understand calls to databases or external services, exceptions to identify errors, and client-side data including user interactions and device information. This telemetry flows into Azure Monitor Logs where it can be queried alongside infrastructure data, giving developers a complete view of how their application behaves in production.
The service offers several features that go beyond basic logging. Live Metrics shows real-time performance data, letting you spot bottlenecks as they happen rather than waiting for users to report problems. Application Map visualizes the relationships between your services and dependencies, making it easy to trace where failures originate in complex distributed systems. You can also set up alerts through Azure Monitor to notify your team when response times spike or error rates increase, ensuring someone knows about problems even outside business hours.
Getting started with Application Insights involves adding connection strings or instrumentation keys to your application code or environment. For Azure services like App Service or Kubernetes, you can use autoinstrumentation, which enables monitoring without any code changes. For other environments, you add a small SDK to your application that handles the telemetry collection automatically. Once configured, telemetry begins flowing to Azure Monitor Logs immediately, and you can start analyzing it with KQL queries to improve response times and optimize user experience.
The data Application Insights collects helps teams make informed decisions about application improvements. By analyzing request rates, response times, and failure patterns, you can identify which features users engage with most, where performance bottlenecks exist, and which errors affect the most users. This data-driven approach lets you prioritize development work on the improvements that matter most to users and business outcomes.
Azure Monitor collects logs and metrics from Azure resources and provides several ways to visualize that data for different audiences and purposes. Azure Workbooks serve as a flexible canvas for creating interactive reports that combine data from Log Analytics, metrics, and other sources. You can build charts, grids, and tiles that let users filter and explore data dynamically. Workbooks include built-in templates and community-contributed designs that help you get started quickly, and they support hybrid scenarios including Azure Arc and edge computing environments.
Azure Dashboards provide a single, high-level view of your cloud resources and metrics across multiple Azure services. While less customizable than workbooks, dashboards integrate data from Monitor, Application Insights, and other Azure services into one pane of glass. You can pin specific workbook sections or metric charts directly to a dashboard for quick access. Dashboards work well for team-wide reporting and executive overviews where you need at-a-glance visibility into system health.
For more specialized visualization needs, Grafana and Power BI extend your options beyond the Azure portal. Grafana specializes in operational dashboards and offers plugins for multicloud and third-party tools, with Azure Managed Grafana simplifying connections to Monitor metrics and logs. Power BI focuses on business-centric reporting, letting you combine Azure Monitor data with other data sources for long-term trend analysis and sharing reports via web or mobile apps. Choosing between these tools depends on your audience: operations teams typically prefer Grafana's real-time operational views, while business stakeholders often favor Power BI's presentation-ready reports.
The Azure Monitor REST API enables custom integrations when built-in visualization options don't meet your needs. You can build proprietary dashboards or embed monitoring data into existing applications, giving you full control over how data is presented and who can access it. This flexibility lets organizations design user interfaces that match their specific workflows and share insights with stakeholders in the formats they prefer. By combining workbooks, dashboards, and third-party tools, you create a comprehensive reporting framework that keeps everyone informed about system performance and health.
Start here! Get your feet wet with the Microsoft cloud and begin your journey to earning your Microsoft Certified: Azure Fundamentals certification!
Prepare and test your skills
Prepare and test your skills
Azure Monitor serves as the central hub for collecting, analyzing, and acting on telemetry from applications and infrastructure running in Azure or on-premises. The service pulls together data from multiple sources including metrics (numerical measurements like CPU usage), logs (detailed event records), and activity events (management operations like resource creation) into one unified platform.
Log Analytics uses Kusto Query Language (KQL), a declarative language designed specifically for searching and visualizing log data. KQL lets you filter data to show only relevant events, aggregate numbers to see totals or averages, and render results as tables or charts using commands like where, summarize, and render.
The three main alert types are metric alerts, log alerts, and activity log alerts. Metric alerts watch numerical values like CPU percentage or memory usage. Log alerts run KQL queries against Azure Monitor Logs to find specific events. Activity log alerts track management operations like someone creating or deleting a resource.
Application Insights automatically gathers telemetry from your code by tracking HTTP requests, database calls, exceptions, and user interactions without requiring you to write logging code manually. Its autoinstrumentation feature lets you enable monitoring just by adding a connection string to your app, making it accessible even to developers who are not monitoring experts.
An organization hosts cloud workloads and databases across Azure and needs a centralized platform to track system health. The operations team must satisfy the following technical requirements:
Which Azure service meets these requirements?
StudyCerts
StudyCerts