Alerts & Notifications
Metric · Log search · Activity log · Service Health · Action groups
Practice questions for this topic →
Alert types
| Type | Use when | Billing |
|---|---|---|
| Metric alert | Data is already in metrics (precomputed), little manipulation | Per time series monitored |
| Log search alert | Advanced logic over logs with KQL | By evaluation interval (more frequent costs more); by dimension time series when splitting |
| Simple log search alert | Unaggregated real-time monitoring: every matching record alerts (for example each failed job) | Billed like 1-minute alerts |
| Activity log alert | Control-plane events: restart, shutdown, create or delete of a resource | See pricing page |
| Service Health alert | Azure platform incidents, maintenance and advisories for your services and regions | See pricing page |
| Resource Health alert | A specific resource becomes unavailable | See pricing page |
| Smart detection | Application Insights anomaly detection | — |
| Prometheus alert | PromQL over Azure Monitor managed Prometheus | Charged on data queried |
Action groups
- An action group is a collection of notifications (voice call, SMS, push, email) and automated actions (webhook, Azure Function, Logic Apps). Used by Azure Monitor, Service Health and Advisor.
- Up to 5 action groups per alert rule; they run concurrently, in no specific order; one action group can serve many alert rules.
- Processing region: Global (stored in at least two regions; may process anywhere; resilient) or Regional (stays in a chosen geography; zone-redundant). Service Health alerts need a Global action group.
Alert processing rules
- Formerly action rules (resource type Microsoft.AlertsManagement/actionRules). They modify alerts after they fire: add or suppress action groups, on a schedule, for a scope within the same subscription. They also cover alerts not created by an alert rule, such as Azure Backup alerts.
Exam Tips
Tick each tip once you can answer it without looking.
“Notify when anyone deletes a resource in production” → Activity log alert.
“Be told when an Azure outage affects your regions/services” → Service Health alert. Trap: Resource Health is per-resource, not service-wide.
“CPU > 80% for 5 minutes, with seasonal baseline” → Metric alert with dynamic thresholds.
“Alert when a KQL query across several tables returns rows” → Log search alert.
“Silence notifications during a weekly maintenance window without disabling rules” → Alert processing rule (suppression schedule).
“Auto-restart a service when an alert fires” → Action group → Automation runbook / Function / Logic App.
“Reuse the same notification list across many alert rules” → One action group referenced by all rules.
“Create a ticket in ServiceNow when an alert fires” → Action group ITSM / webhook action.
“Action group limits” → Up to 5 per alert rule, run concurrently in no set order, reusable across rules. Trap: Actions include voice, SMS, push, email, webhook, Function and Logic Apps.
“Action group processing region” → Global (stored in at least two regions) or Regional (zone-redundant, stays in a geography). Trap: Service Health alerts need a Global action group.
“How alert types are billed” → Metric: per time series. Log search: by evaluation interval. Prometheus: data queried. Trap: Simple log search alerts bill like 1-minute alerts.
“Alert on every failed job with no aggregation” → Simple log search alert. Trap: A regular log search alert aggregates.