Azure Learning

configure-alerts-and-action-groups

Properties1
tagsaz-104, monitor, module, alerts, action-groups

3 min read

Configure Alerts and Action Groups

MS Learn/monitoring guidance: grounded in Microsoft Learn Azure Monitor alerts & action groups — Overview of Azure Monitor alerts and the alerts/action-group work taught in the AZ-104 monitoring module. Learning objectives: create metric alerts that fire on a condition and use an action group to notify (email/SMS/push/webhook) and automate (runbook/Function) responses; understand the different alert signals.

Overview (why this module matters)

Monitoring collects data; alerts turn that data into action. This module covers how to build alert rules (signal + condition + threshold + frequency) and wire them to action groups so the right people/tools react automatically to problems. Alerts are the operator’s early-warning system and a heavy AZ-104 exam topic.

Units / lessons covered

  • Understand the four alert signals: metric, log (KQL), activity log, resource/availability.
  • Create a metric alert rule (resource + signal + condition/threshold + frequency + severity).
  • Create and reuse action groups (email, SMS, push, voice, webhook, ITSM, runbook, Function, Logic App).
  • Alert severity/state, alert rules in Monitor → Alerts, and alert processing rules (suppress/deselect).
  • Metric alerts — numeric-signal alert rules (fastest, lowest-cost).
  • Action groups — the named set of notification/automation actions an alert invokes.
  • Azure Monitor — where alert rules live (Monitor → Alerts).
  • Log Analytics — source for log/KQL alerts (scheduled query that matches → alert).
  • Activity log — source for activity-log alerts (management event happens → alert).

Key terms / commands

  • Alert rule = resource + signal + condition + threshold + frequency; can attach multiple action groups.
  • az monitor metrics alert create / PowerShell New-AzMetricAlertRule; action groups via az monitor action-group create.
  • Action group actions: email, SMS, push (Azure app), voice, webhook, ITSM (ServiceNow), Automation runbook, Azure Function, Logic App.
  • Severity 0-4 and alert state (new/acknowledged/closed) are management concepts, separate from the rule.

Hands-on / what to try

  • Create an action group with email + webhook (can be empty initially, add later).
  • Create a metric alert “CPU > 80% for 5 min” on a VM and attach the action group; trigger it to verify the email.
  • Create a log alert on a KQL query and an activity-log alert (“when a VM is deleted”).

Exam focus

  • Alert rule (detection) vs action group (notification) — know how they combine.
  • Metric vs log (KQL) vs activity-log signals — which signal type for which scenario.
  • Action group actions list (email/SMS/push/voice/webhook/runbook/Function/Logic App/ITSM) is repeatedly asked.
  • Alert processing rules (suppress during maintenance, filter) are a newer exam topic.

Path MOC · metric-alert · action-group · azure-monitor · Prev: monitor resources

Graph View

Backlinks